fix(docker): replace anonymous docker volume with env variable for encrypting secrets (#1809)

scripts/generateRandomSecureKey.js

@@ -1,7 +0,0 @@
-// This script generates a random secure key with a length of 64 characters
-// This key is used to encrypt and decrypt the integration secrets for auth.js
-// In production it is generated in run.sh and stored in the environment variables ENCRYPTION_KEY / AUTH_SECRET
-// during runtime, it's also stored in a file.
-
-const crypto = require("crypto");
-console.log(crypto.randomBytes(32).toString("hex"));

scripts/run.sh

@@ -6,31 +6,8 @@ else
     node ./db/migrations/$DB_DIALECT/migrate.cjs ./db/migrations/$DB_DIALECT
 fi
 
-# Generates an encryption key if it doesn't exist and saves it to /secrets/encryptionKey
-# Also sets the ENCRYPTION_KEY environment variable
-encryptionKey=""
-if [ -r /secrets/encryptionKey ]; then
-    echo "Encryption key already exists"
-    encryptionKey=$(cat /secrets/encryptionKey)
-else
-    echo "Generating encryption key"
-    encryptionKey=$(node ./generateRandomSecureKey.js)
-    echo $encryptionKey > /secrets/encryptionKey
-fi
-export ENCRYPTION_KEY=$encryptionKey
-
-# Generates an auth secret if it doesn't exist and saves it to /secrets/authSecret
-# Also sets the AUTH_SECRET environment variable required for auth.js
-authSecret=""
-if [ -r /secrets/authSecret ]; then
-    echo "Auth secret already exists"
-    authSecret=$(cat /secrets/authSecret)
-else
-    echo "Generating auth secret"
-    authSecret=$(node ./generateRandomSecureKey.js)
-    echo $authSecret > /secrets/authSecret
-fi
-export AUTH_SECRET=$authSecret
+# Auth secret is generated every time the container starts as it is required, but not used because we don't need JWTs or Mail hashing
+export AUTH_SECRET=$(openssl rand -base64 32)
 
 # Start nginx proxy
 # 1. Replace the HOSTNAME in the nginx template file