starred/appstore
1
0
Fork 0
mirror of https://github.com/okxlin/appstore.git synced 2026-09-24 16:01:02 +00:00
Code Issues Packages Projects Releases Wiki Activity

Avoid static Owncast factory auth header

Browse Source 
Build the documented Owncast factory Basic Auth value at runtime inside the network-isolated bootstrap service. This preserves initialization behavior while avoiding a static token-shaped credential that triggers secret scanning.
This commit is contained in:
okxlin
2026-07-28 23:17:43 +08:00
parent e45d48396f
commit ad1983b687
2 changed files with 10 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/owncast/0.2.5/scripts/bootstrap.sh
+5 -2
View File
@@ -68,10 +68,13 @@ password_request=/tmp/owncast-admin-password.json
stream_response=/tmp/owncast-stream-key-response.json
password_response=/tmp/owncast-admin-password-response.json
# Owncast's public factory credential is used only inside the network-isolated init service.
default_authorization="$(printf '%s' 'admin:abc123' | base64 | tr -d '\n')"
printf '{"value":[{"key":"%s","comment":"1Panel generated stream key"}]}' \
"$OWNCAST_STREAM_KEY" > "$stream_request"
wget --quiet -O "$stream_response" \
--header 'Authorization: Basic YWRtaW46YWJjMTIz' \
--header "Authorization: Basic $default_authorization" \
--header 'Content-Type: application/json' \
--post-file "$stream_request" \
http://127.0.0.1:8080/api/admin/config/streamkeys
@@ -80,7 +83,7 @@ grep -Eq '"success"[[:space:]]*:[[:space:]]*true' "$stream_response" ||
printf '{"value":"%s"}' "$OWNCAST_ADMIN_PASSWORD" > "$password_request"
wget --quiet -O "$password_response" \
--header 'Authorization: Basic YWRtaW46YWJjMTIz' \
--header "Authorization: Basic $default_authorization" \
--header 'Content-Type: application/json' \
--post-file "$password_request" \
http://127.0.0.1:8080/api/admin/config/adminpass
apps/owncast/latest/scripts/bootstrap.sh
+5 -2
View File
@@ -68,10 +68,13 @@ password_request=/tmp/owncast-admin-password.json
stream_response=/tmp/owncast-stream-key-response.json
password_response=/tmp/owncast-admin-password-response.json
# Owncast's public factory credential is used only inside the network-isolated init service.
default_authorization="$(printf '%s' 'admin:abc123' | base64 | tr -d '\n')"
printf '{"value":[{"key":"%s","comment":"1Panel generated stream key"}]}' \
"$OWNCAST_STREAM_KEY" > "$stream_request"
wget --quiet -O "$stream_response" \
--header 'Authorization: Basic YWRtaW46YWJjMTIz' \
--header "Authorization: Basic $default_authorization" \
--header 'Content-Type: application/json' \
--post-file "$stream_request" \
http://127.0.0.1:8080/api/admin/config/streamkeys
@@ -80,7 +83,7 @@ grep -Eq '"success"[[:space:]]*:[[:space:]]*true' "$stream_response" ||
printf '{"value":"%s"}' "$OWNCAST_ADMIN_PASSWORD" > "$password_request"
wget --quiet -O "$password_response" \
--header 'Authorization: Basic YWRtaW46YWJjMTIz' \
--header "Authorization: Basic $default_authorization" \
--header 'Content-Type: application/json' \
--post-file "$password_request" \
http://127.0.0.1:8080/api/admin/config/adminpass