From 25df78c51923ef41f0d665e0e8dba80f936a0ab0 Mon Sep 17 00:00:00 2001
From: datadunia <datadunia@ymail.com>
Date: Sun, 31 May 2026 06:14:28 +0700
Subject: [PATCH] chore: auto-generate secrets in nexusguard-install.sh, remove
 redundant install.sh

---
 apps/server-core      |  2 +-
 nexusguard-install.sh | 45 +++++++++++++++++++++++--------------------
 2 files changed, 25 insertions(+), 22 deletions(-)

diff --git a/apps/server-core b/apps/server-core
index c6911c6..70b81b8 160000
--- a/apps/server-core
+++ b/apps/server-core
@@ -1 +1 @@
-Subproject commit c6911c695156fd4286f202b0c00d03b7ac3bb951
+Subproject commit 70b81b8aab9ef63e6c7a390f913bdbe738825b6f
diff --git a/nexusguard-install.sh b/nexusguard-install.sh
index ef67d1a..ad88c9e 100644
--- a/nexusguard-install.sh
+++ b/nexusguard-install.sh
@@ -103,40 +103,43 @@ cp -r "$DASHBOARD_DIST"/* "$DASHBOARD_DIR/"
 
 # Create config file (only if not exists)
 if [ ! -f "$CONF_FILE" ]; then
-    info "Creating config file..."
+    info "Creating config file with auto-generated secrets..."
+    
+    RANDOM_JWT=$(openssl rand -hex 32)
+    RANDOM_SALT=$(openssl rand -hex 32)
+    
     cat << EOF > "$CONF_FILE"
 # NexusGuard Configuration
-# This file is sourced by the server-core and nginx
+# Generated by install.sh on $(date)
 
 # Database
-export DB_HOST=127.0.0.1
-export DB_PORT=5432
-export DB_USER=nexusguard
-export DB_PASSWORD=nexusguard
-export DB_NAME=nexusguard
+DB_HOST=127.0.0.1
+DB_PORT=5432
+DB_USER=nexusguard
+DB_PASSWORD=nexusguard
+DB_NAME=nexusguard
 
 # Redis
-export REDIS_ADDR=127.0.0.1:6379
+REDIS_ADDR=127.0.0.1:6379
 
-# Security (CHANGE THESE!)
-export JWT_SECRET=change-me-to-a-random-string
-export SERVER_SALT=change-me-to-another-random-string
+# Security (auto-generated)
+JWT_SECRET=$RANDOM_JWT
+SERVER_SALT=$RANDOM_SALT
 
 # Network
-export NFTABLES_TABLE=nexusguard
-export IPAM_POOL=10.8.0.0/16
+NFTABLES_TABLE=nexusguard
+IPAM_POOL=10.8.0.0/16
 
 # Server
-export GIN_MODE=release
-export PORT=$SERVER_PORT
+GIN_MODE=release
+PORT=$SERVER_PORT
 
 # Dashboard
-export API_BASE_URL=http://localhost:$SERVER_PORT/api/v1
-export WEB_PORT=$WEB_PORT
+CORS_ALLOWED_ORIGINS=http://localhost:$WEB_PORT
+SHARE_LINK_TTL=24h
 EOF
     chmod 600 "$CONF_FILE"
-    warn "Config file created at $CONF_FILE"
-    warn "IMPORTANT: Edit $CONF_FILE and set JWT_SECRET and SERVER_SALT!"
+    info "Config file created at $CONF_FILE"
 else
     info "Config file already exists, skipping..."
 fi
@@ -218,5 +221,5 @@ info "Access URL: http://localhost:$WEB_PORT"
 info "Config file: $CONF_FILE"
 info "Service status: systemctl status $SERVICE_NAME"
 echo ""
-warn "IMPORTANT: Edit $CONF_FILE to set secure JWT_SECRET and SERVER_SALT values!"
-warn "Then restart the service: systemctl restart $SERVICE_NAME"
+info "Secrets were auto-generated. Edit $CONF_FILE to customize if needed."
+info "Restart after changes: systemctl restart $SERVICE_NAME"