simple-web-app

commit d1a959863e0625d2968db158bf0dd23381c1c35c
parent 7c1046bcf16f2596604dc4f27b66d3897d03018e
Author: Silas Brack <silasbrack@gmail.com>
Date:   Sat, 13 Jun 2026 12:43:10 +0200

refactor: generate JWT secret randomly on startup

No reason to configure or persist the JWT secret. Restarts log
everyone out, which is fine. Removes JWT_SECRET from env vars,
sops, and NixOS module.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Diffstat:
M
.env.example
 | 
1
-
M
src/config.rs
 | 
6
+++++-

2 files changed, 5 insertions(+), 2 deletions(-)
diff --git a/.env.example b/.env.example
@@ -1,5 +1,4 @@
 DB_PATH=data/app.db
-JWT_SECRET=change-me-to-a-random-string
 DEBUG=true
 PORT=8000
 SMTP_HOST=localhost
diff --git a/src/config.rs b/src/config.rs
@@ -27,7 +27,11 @@ impl Config {
     pub fn from_env() -> Self {
         Self {
             db_path: require("DB_PATH"),
-            jwt_secret: require("JWT_SECRET"),
+            jwt_secret: {
+                use rand::Rng;
+                let bytes: [u8; 32] = rand::thread_rng().gen();
+                bytes.iter().map(|b| format!("{:02x}", b)).collect()
+            },
             debug: require_parse("DEBUG"),
             port: require_parse("PORT"),
             smtp_host: require("SMTP_HOST"),