From ad1983b6879f8ece5e51cb242523f2e9ff003298 Mon Sep 17 00:00:00 2001
From: okxlin <61420215+okxlin@users.noreply.github.com>
Date: Tue, 28 Jul 2026 23:17:43 +0800
Subject: [PATCH] Avoid static Owncast factory auth header

Build the documented Owncast factory Basic Auth value at runtime inside the network-isolated bootstrap service. This preserves initialization behavior while avoiding a static token-shaped credential that triggers secret scanning.
---
 apps/owncast/0.2.5/scripts/bootstrap.sh  | 7 +++++--
 apps/owncast/latest/scripts/bootstrap.sh | 7 +++++--
 2 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/apps/owncast/0.2.5/scripts/bootstrap.sh b/apps/owncast/0.2.5/scripts/bootstrap.sh
index 3bfc20265..81a86ccfc 100755
--- a/apps/owncast/0.2.5/scripts/bootstrap.sh
+++ b/apps/owncast/0.2.5/scripts/bootstrap.sh
@@ -68,10 +68,13 @@ password_request=/tmp/owncast-admin-password.json
 stream_response=/tmp/owncast-stream-key-response.json
 password_response=/tmp/owncast-admin-password-response.json
 
+# Owncast's public factory credential is used only inside the network-isolated init service.
+default_authorization="$(printf '%s' 'admin:abc123' | base64 | tr -d '\n')"
+
 printf '{"value":[{"key":"%s","comment":"1Panel generated stream key"}]}' \
   "$OWNCAST_STREAM_KEY" > "$stream_request"
 wget --quiet -O "$stream_response" \
-  --header 'Authorization: Basic YWRtaW46YWJjMTIz' \
+  --header "Authorization: Basic $default_authorization" \
   --header 'Content-Type: application/json' \
   --post-file "$stream_request" \
   http://127.0.0.1:8080/api/admin/config/streamkeys
@@ -80,7 +83,7 @@ grep -Eq '"success"[[:space:]]*:[[:space:]]*true' "$stream_response" ||
 
 printf '{"value":"%s"}' "$OWNCAST_ADMIN_PASSWORD" > "$password_request"
 wget --quiet -O "$password_response" \
-  --header 'Authorization: Basic YWRtaW46YWJjMTIz' \
+  --header "Authorization: Basic $default_authorization" \
   --header 'Content-Type: application/json' \
   --post-file "$password_request" \
   http://127.0.0.1:8080/api/admin/config/adminpass
diff --git a/apps/owncast/latest/scripts/bootstrap.sh b/apps/owncast/latest/scripts/bootstrap.sh
index 3bfc20265..81a86ccfc 100755
--- a/apps/owncast/latest/scripts/bootstrap.sh
+++ b/apps/owncast/latest/scripts/bootstrap.sh
@@ -68,10 +68,13 @@ password_request=/tmp/owncast-admin-password.json
 stream_response=/tmp/owncast-stream-key-response.json
 password_response=/tmp/owncast-admin-password-response.json
 
+# Owncast's public factory credential is used only inside the network-isolated init service.
+default_authorization="$(printf '%s' 'admin:abc123' | base64 | tr -d '\n')"
+
 printf '{"value":[{"key":"%s","comment":"1Panel generated stream key"}]}' \
   "$OWNCAST_STREAM_KEY" > "$stream_request"
 wget --quiet -O "$stream_response" \
-  --header 'Authorization: Basic YWRtaW46YWJjMTIz' \
+  --header "Authorization: Basic $default_authorization" \
   --header 'Content-Type: application/json' \
   --post-file "$stream_request" \
   http://127.0.0.1:8080/api/admin/config/streamkeys
@@ -80,7 +83,7 @@ grep -Eq '"success"[[:space:]]*:[[:space:]]*true' "$stream_response" ||
 
 printf '{"value":"%s"}' "$OWNCAST_ADMIN_PASSWORD" > "$password_request"
 wget --quiet -O "$password_response" \
-  --header 'Authorization: Basic YWRtaW46YWJjMTIz' \
+  --header "Authorization: Basic $default_authorization" \
   --header 'Content-Type: application/json' \
   --post-file "$password_request" \
   http://127.0.0.1:8080/api/admin/config/adminpass