From f0600959270b9ed4bc754783c1a58b8e3a666554 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ga=C3=ABl=20Goinvic?= Date: Tue, 25 Aug 2026 14:36:17 +0200 Subject: [PATCH 1/2] Add comment around the config sample --- config.sample.yaml | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/config.sample.yaml b/config.sample.yaml index fb94f0e..e5c81e7 100644 --- a/config.sample.yaml +++ b/config.sample.yaml @@ -118,7 +118,13 @@ download: crypto: # Path to the file containing the request secret. # The secret is used to derive the key pair for encrypting and decrypting - # POST request bodies. The secret itself must be exactly 32 bytes, then - # base64-encoded. + # POST request bodies. The secret itself must be an x25519 private key, + # consisting of 32 bytes, then base64-encoded. + # The secret can be generated with: + # + # openssl genpkey -algorithm X25519 -outform DER \ + # | openssl asn1parse -inform DER -strparse 14 -out /dev/stdout -noout \ + # | openssl enc -base64 -A > ./path/to/request_secret + # # Required. request_secret_path: "./request_secret" From ef9c31349c2c428751633001b08a92093d6afad4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ga=C3=ABl=20Goinvic?= Date: Fri, 4 Sep 2026 14:22:35 +0200 Subject: [PATCH 2/2] Adjust documentation --- config.sample.yaml | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/config.sample.yaml b/config.sample.yaml index e5c81e7..5322828 100644 --- a/config.sample.yaml +++ b/config.sample.yaml @@ -119,12 +119,9 @@ crypto: # Path to the file containing the request secret. # The secret is used to derive the key pair for encrypting and decrypting # POST request bodies. The secret itself must be an x25519 private key, - # consisting of 32 bytes, then base64-encoded. + # consisting of 32 random bytes, then base64-encoded. # The secret can be generated with: # - # openssl genpkey -algorithm X25519 -outform DER \ - # | openssl asn1parse -inform DER -strparse 14 -out /dev/stdout -noout \ - # | openssl enc -base64 -A > ./path/to/request_secret - # + # openssl rand -base64 32 > ./path/to/request_secret # Required. request_secret_path: "./request_secret"