app-catalog-felhom.eu/REPORT.md

REPORT — crafty-controller: seed a felhom-generated admin password (gokapi pattern)

Date: 2026-06-26 · Repo: app-catalog-felhom.eu (catalog-only) · Commit: 5a403d1 Guest: 9201 (demo-felhom) on felhom-pve · Controller: v0.84.0 (unchanged — reuses its initial_credentials reader)

Goal

Replace Crafty's auto-generated, ugly random admin password with a clean felhom-generated one, using the same seeding pattern as gokapi (consistency), while keeping it visible on the app page.

Root mechanism (discovered in Crafty source)

main_models.default_settings reads app/config/default.json on fresh install; the image ships config_original/default.json = {"username":"admin","password":"crafty"} — 6 chars, below Crafty's 8-char minimum, so Crafty rejected it and generated a random password into default-creds.txt. We can't "lengthen" that internal fallback — we seed a valid default.json instead.

Change (catalog-only)

• docker-compose.yml: new CRAFTY_PASSWORD env + an entrypoint wrapper that overwrites config_original/default.json with {"username":"admin","password":"$CRAFTY_PASSWORD"} before exec'ing the image launcher (/crafty/docker_launcher.sh -d -i). On fresh install the launcher copies our template into the config volume → Crafty creates admin with our password.
• .felhom.yml: new CRAFTY_PASSWORD deploy field (type: password, generate: password:24, locked_after_deploy — mirrors gokapi's GOKAPI_PASSWORD, alphanumeric so JSON/shell-safe). Repointed initial_credentials.file default-creds.txt → default.json so the controller's "Kezdeti belépési adatok" card shows the seeded password.
• No controller change: the deploy flow already injects/decrypts password deploy-fields into the compose env (stackEnv), and v0.84.0's initial_credentials reader already parses default.json.

Live validation (guest 9201 — fresh install via the real pipeline)

Removed crafty + wiped its volumes, then deployed via POST /api/stacks/crafty-controller/deploy with {DOMAIN, SUBDOMAIN, CRAFTY_PASSWORD} (clean 24-char alphanumeric).

Check	Result
Fresh install, no "Default password too short"	✅ Crafty used our seeded password
default.json in volume	{"username":"admin","password":"<seeded>"}
Crafty API login admin/seeded	HTTP 200 + token (gold standard)
Stray default-creds.txt random pw	401 rejected — non-functional artifact (see note)
app.yaml	CRAFTY_PASSWORD: ENC:… (encrypted at rest) + in locked_fields
App-page card	shows the seeded password (from default.json)
Public URL minecraft.demo-felhom.eu	302

Known quirk (documented, low-risk)

Crafty still writes default-creds.txt with a different random password during init even though it used our default.json. That password is non-functional (login → 401) and the file is not shown anywhere in the felhom UI (the card reads default.json; FileBrowser is scoped to userdata, not /crafty/app/config). Left as-is — a post-boot cleanup would be a racy entrypoint hack for an invisible file. The canonical, working password is the seeded one shown on the app page.

Consistency

crafty now matches gokapi: a felhom-generated, locked, password-type deploy field set at deploy time — plus the app-page card (v0.84.0 reader) so the initial login is also visible there.