awkawb/hortusfox-web-nixos
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add adminAccount.email, decoupled from the seeded admin's assumed domain email

Browse Source 
The seeded admin account's email was hardcoded to admin@<domain>, which
isn't necessarily a mailbox the deployer can actually receive mail at --
notably breaking HortusFox's own "Restore password" flow, which emails
that address. Make it a separate, overridable option (still defaulting
to admin@<domain> for compatibility).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
awkawb
2026-09-27 17:14:22 -04:00
co-authored by Claude Sonnet 5
parent c7888c3f9d
commit 150d307020
2 changed files with 20 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
nixos-module/default.nix
+19 -5
View File
@@ -207,14 +207,28 @@ in {
migrate:fresh); changing it afterwards has no effect on an
existing account.
Seeds a user named "admin", email "admin@''${domain}", bcrypt-hashed
via `password_hash(..., PASSWORD_BCRYPT)` (matching UserModel's own
hashing) and inserted directly into the UserModel table with the
admin flag set, bypassing the app's normal two-step
Seeds a user named "admin" (email set via adminAccount.email),
bcrypt-hashed via `password_hash(..., PASSWORD_BCRYPT)` (matching
UserModel's own hashing) and inserted directly into the UserModel
table with the admin flag set, bypassing the app's normal two-step
create-then-promote admin-panel flow.
'';
};
adminAccount.email = lib.mkOption {
type = lib.types.str;
default = "admin@${cfg.domain}";
example = "you@realmail.com";
description = ''
Email address for the seeded admin account (see
adminAccount.passwordFile). Defaults to admin@<domain>, but that's
just a guess -- it's not necessarily a mailbox anyone can actually
receive mail at, and HortusFox's own "Restore password" flow emails
this address. Set it to a real address you control if you intend to
use password reset.
'';
};
settings = lib.mkOption {
type = lib.types.attrsOf (lib.types.oneOf [ lib.types.str lib.types.int lib.types.bool ]);
default = { };
@@ -358,7 +372,7 @@ in {
# this point.
${lib.optionalString (cfg.adminAccount.passwordFile != null) ''
admin_hash="$(php -r 'echo password_hash($argv[1], PASSWORD_BCRYPT);' "$(cat "${cfg.adminAccount.passwordFile}")")"
mariadb "${cfg.database.name}" -e "INSERT INTO UserModel (name, email, password, admin) VALUES ('admin', 'admin@${cfg.domain}', '$admin_hash', 1);"
mariadb "${cfg.database.name}" -e "INSERT INTO UserModel (name, email, password, admin) VALUES ('admin', '${cfg.adminAccount.email}', '$admin_hash', 1);"
''}
touch "${stateDir}/.installed"