.env.example

@@ -1,7 +1,6 @@
 # Copy to .env for Docker / local development secrets
 # These override values in config.yaml
 
-STEWARD_SECRET_KEY=change-me
 STEWARD_DATABASE_URL=postgresql+asyncpg://steward:password@localhost/steward
 STEWARD_SMTP__PASSWORD=
 

compose.deploy.yml

@@ -23,10 +23,9 @@ services:
       - app_data:/data
     environment:
       - STEWARD_DATABASE_URL=postgresql+asyncpg://steward:${POSTGRES_PASSWORD:-steward}@db/steward
-      # Optional: if unset, the app generates a key and persists it to
+      # STEWARD_SECRET_KEY is intentionally absent — the app generates a random
-      # /data/secret.key, so sessions survive restarts via the app_data volume.
+      # key on first boot and persists it to /data/secret.key, which the app_data
-      # Set STEWARD_SECRET_KEY in .env to pin it explicitly across volume resets.
+      # volume keeps across image updates.
-      - STEWARD_SECRET_KEY=${STEWARD_SECRET_KEY:-}
     depends_on:
       db:
         condition: service_healthy