diff --git a/README.md b/README.md index 023ccd18..0636c299 100644 --- a/README.md +++ b/README.md @@ -62,10 +62,13 @@ If you are a node runner, start a Routstr Core instance using Docker Compose: ROUTSTR_SECRET_KEY= NAME="My AI Node" DESCRIPTION="Fast access to models" - NSEC=yournsec RECEIVE_LN_ADDRESS=yourname@wallet.com ``` + Your Nostr identity (`nsec`) is not set in `.env` — configure it from the admin + UI after first start, where it's stored encrypted in the database. (`NSEC` in + `.env` is still read once as a legacy seed for existing deployments.) + If you don't set one, a key is generated and printed on first start — save it somewhere safe (losing it makes previously encrypted secrets unreadable). To supply your own, generate it once and keep it stable: diff --git a/docs/provider/configuration.md b/docs/provider/configuration.md index f548c990..33efabb8 100644 --- a/docs/provider/configuration.md +++ b/docs/provider/configuration.md @@ -13,8 +13,6 @@ Before running your node, you should create a `.env` file in the project root. T ### Example .env ```bash -ADMIN_PASSWORD=your-secure-password - # Encrypts node secrets at rest. Optional — if unset, the node generates a key on # first start and prints it once (back it up). Set it to manage the key yourself # (recommended in production). See "Secrets at Rest" below. @@ -30,10 +28,10 @@ RECEIVE_LN_ADDRESS=yourname@wallet.com ### Setting the UI Password -There are two ways to set or change your Admin Dashboard password: +On first start the node generates an admin password and logs it once — read it from the container logs to sign in. You can then change it two ways: -1. **Via Environment Variable**: Set `ADMIN_PASSWORD` in your `.env` file before starting the container. This will be the password used for the first login. -2. **Via Dashboard**: Once logged in, go to **Settings** → **Security** to update your password. Dashboard settings override the `.env` file once saved. +1. **Via Dashboard**: Once logged in, go to **Settings** → **Security** to update your password. +2. **Via Environment Variable (legacy seed)**: Setting `ADMIN_PASSWORD` in `.env` before the first start seeds the initial password instead of generating one. It's read only once, for existing deployments; a value left in `.env` is ignored after the node has been configured. --- @@ -128,14 +126,14 @@ Use environment variables for: | -------------------- | --------------------------------- | ------------------------------------ | | `UPSTREAM_BASE_URL` | Upstream API endpoint | — | | `UPSTREAM_API_KEY` | Upstream API key | — | -| `ADMIN_PASSWORD` | Dashboard password | (none) | +| `ADMIN_PASSWORD` | Legacy seed for the dashboard password (otherwise generated + logged on first start) | (auto-generated) | | `ROUTSTR_SECRET_KEY` | Master key encrypting node secrets at rest. Auto-generated to a key file if unset | (auto-generated) | | `ROUTSTR_SECRET_KEY_FILE` | Path to the generated key file (used when `ROUTSTR_SECRET_KEY` is unset) | `routstr_secret.key` beside the database | | `DATABASE_URL` | Database connection string | `sqlite+aiosqlite:///keys.db` | | `NAME` | Node display name | `ARoutstrNode` | | `DESCRIPTION` | Node description | `A Routstr Node` | | `NPUB` | Nostr public key (bech32) | — | -| `NSEC` | Nostr private key | — | +| `NSEC` | Legacy seed for the Nostr private key (otherwise set from the admin UI) | — | | `ENABLE_ANALYTICS_SHARING` | Enable usage analytics sharing to Nostr | `true` | | `CASHU_MINTS` | Comma-separated mint URLs | `https://mint.minibits.cash/Bitcoin` | | `RECEIVE_LN_ADDRESS` | Lightning address for withdrawals | — | diff --git a/docs/provider/deployment.md b/docs/provider/deployment.md index 3a6fcce3..784a764d 100644 --- a/docs/provider/deployment.md +++ b/docs/provider/deployment.md @@ -38,7 +38,6 @@ services: - routstr-data:/app/data environment: DATABASE_URL: "sqlite:////app/data/routstr.db" - ADMIN_KEY: "your-secure-admin-key" LOG_LEVEL: "info" volumes: @@ -127,8 +126,8 @@ services: - UPSTREAM_BASE_URL=https://api.openai.com/v1 - UPSTREAM_API_KEY=sk-proj-... - # Secure the dashboard (recommended) - - ADMIN_PASSWORD=your-secure-password + # The admin password is generated and logged once on first start; set + # ADMIN_PASSWORD here only as a legacy seed for an existing deployment. # Node identity - NAME=My Provider Node @@ -160,7 +159,6 @@ Example `.env`: ```bash UPSTREAM_BASE_URL=https://api.openai.com/v1 UPSTREAM_API_KEY=sk-proj-... -ADMIN_PASSWORD=change-me # Keep the database (and the key file generated beside it) on the mounted volume. DATABASE_URL=sqlite:////app/data/routstr.db # Encrypts node secrets at rest. Optional — if unset, a key is generated next to diff --git a/docs/provider/quickstart.md b/docs/provider/quickstart.md index ef959f40..b528c803 100644 --- a/docs/provider/quickstart.md +++ b/docs/provider/quickstart.md @@ -29,9 +29,6 @@ In future versions, you'll be able to run a node that connects to other Routstr Create a `.env` file in the root of the project to store your secrets: ```bash -# Initial Admin Password -ADMIN_PASSWORD=mysecretpassword - # Encrypts node secrets at rest. Optional — if unset, the node generates a key on # first start and prints it once (back it up). ROUTSTR_SECRET_KEY= @@ -39,13 +36,18 @@ ROUTSTR_SECRET_KEY= # Node Identity NAME="My AI Node" DESCRIPTION="Fast access to models" -NSEC=yournsec # Lightning Payouts RECEIVE_LN_ADDRESS=yourname@wallet.com ``` +The admin password is generated and logged once on first start (read it from the +logs to sign in), and your Nostr identity (`nsec`) is configured afterwards from +the admin UI — both are stored encrypted in the database, not in `.env`. +(`ADMIN_PASSWORD` / `NSEC` are still read once as a legacy seed for existing +deployments.) + ## 2. Start the Node The recommended way to run Routstr is using Docker Compose, which handles the node, the UI, and optional services like Tor. @@ -76,7 +78,7 @@ docker compose up -d Open the **Admin Dashboard** at [http://localhost:8000/admin/](http://localhost:8000/admin/). !!! note "Login" -Use the `ADMIN_PASSWORD` you defined in your `.env` file to log in. If you didn't set one, the dashboard will prompt you to set one on first visit. +On first start the node generates an admin password and logs it once — read it from the container logs to sign in. You can change it afterwards from **Settings** → **Security**. ### Connect Your AI Providers