Update CHANGELOG.md

CHANGELOG.md

@@ -597,6 +597,7 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
   - #### 🔧 Refactor
 
+    - security: remove hardcoded credentials in several scripts [@MickLesk](https://github.com/MickLesk) ([#18572](https://github.com/community-scripts/ProxmoxVE/pull/18572))
     - yuvomi: install from the attested release asset [@ulsklyc](https://github.com/ulsklyc) ([#18554](https://github.com/community-scripts/ProxmoxVE/pull/18554))
 
 ### 🗑️ Deleted Scripts

ct/homeassistant.sh

@@ -70,32 +70,7 @@ function update_script() {
     exit
   fi
   if [ "$UPD" == "4" ]; then
-    msg_info "Installing FileBrowser"
-    RELEASE=$(curl -fsSL https://api.github.com/repos/filebrowser/filebrowser/releases/latest | grep -o '"tag_name": ".*"' | sed 's/"//g' | sed 's/tag_name: //g')
-    $STD curl -fsSL https://github.com/filebrowser/filebrowser/releases/download/v2.23.0/linux-$(arch_resolve)-filebrowser.tar.gz | tar -xzv -C /usr/local/bin
-    $STD filebrowser config init -a '0.0.0.0'
-    $STD filebrowser config set -a '0.0.0.0'
-    $STD filebrowser users add admin community-scripts.org --perm.admin
-    msg_ok "Installed FileBrowser"
-
-    msg_info "Creating Service"
-    service_path="/etc/systemd/system/filebrowser.service"
-    echo "[Unit]
-Description=Filebrowser
-After=network-online.target
-[Service]
-User=root
-WorkingDirectory=/root/
-ExecStart=/usr/local/bin/filebrowser -r /
-[Install]
-WantedBy=default.target" >$service_path
-
-    $STD systemctl enable --now filebrowser
-    msg_ok "Created Service"
-
-    msg_ok "Completed successfully!\n"
-    echo -e "FileBrowser should be reachable by going to the following URL.
-         ${BL}http://$LOCAL_IP:8080${CL}   admin|community-scripts.org\n"
+    bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/tools/addon/filebrowser.sh)"
     exit
   fi
 }

ct/podman-homeassistant.sh

@@ -66,33 +66,7 @@ function update_script() {
     exit
   fi
   if [ "$UPD" == "3" ]; then
-    msg_info "Installing FileBrowser"
-    $STD curl -fsSL https://raw.githubusercontent.com/filebrowser/get/master/get.sh | bash
-    $STD filebrowser config init -a '0.0.0.0'
-    $STD filebrowser config set -a '0.0.0.0'
-    $STD filebrowser users add admin community-scripts.org --perm.admin
-    msg_ok "Installed FileBrowser"
-
-    msg_info "Creating Service"
-    cat <<EOF >/etc/systemd/system/filebrowser.service
-[Unit]
-Description=Filebrowser
-After=network-online.target
-
-[Service]
-User=root
-WorkingDirectory=/root/
-ExecStart=/usr/local/bin/filebrowser -r /
-
-[Install]
-WantedBy=default.target
-EOF
-    systemctl enable -q --now filebrowser
-    msg_ok "Created Service"
-
-    msg_ok "Completed successfully!\n"
-    echo -e "FileBrowser should be reachable by going to the following URL.
-         ${BL}http://$LOCAL_IP:8080${CL}   admin|community-scripts.org\n"
+    bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/tools/addon/filebrowser.sh)"
     exit
   fi
   if [ "$UPD" == "4" ]; then

install/archivebox-install.sh

@@ -48,6 +48,7 @@ chown -R archivebox:archivebox /opt/archivebox/{data,.npm,.cache,.local}
 chmod -R 755 /opt/archivebox/data
 $STD uv pip install archivebox --system --break-system-packages
 cd /opt/archivebox/data
+ADMIN_PASS=$(random_password 20)
 expect <<EOF
 set timeout -1
 log_user 0
@@ -62,13 +63,18 @@ expect "Email address"
 send "\r"
 
 expect "Password"
-send "community-scripts.org\r"
+send "${ADMIN_PASS}\r"
 
 expect "Password (again)"
-send "community-scripts.org\r"
+send "${ADMIN_PASS}\r"
 
 expect eof
 EOF
+{
+  echo "ArchiveBox Credentials"
+  echo "Username: archivebox"
+  echo "Password: ${ADMIN_PASS}"
+} >~/archivebox.creds
 msg_ok "Installed ArchiveBox"
 
 msg_info "Creating Service"

install/authelia-install.sh

@@ -63,12 +63,19 @@ else
 fi
 echo "$AUTHELIA_URL" >/etc/authelia/.authelia_url
 
+AUTHELIA_PASS=$(random_password 20)
+AUTHELIA_HASH=$(authelia crypto hash generate argon2 --password "$AUTHELIA_PASS" | awk '/Digest:/{print $2}')
+{
+  echo "Authelia Credentials"
+  echo "Username: authelia"
+  echo "Password: ${AUTHELIA_PASS}"
+} >~/authelia.creds
 cat <<EOF >/etc/authelia/users.yml
 users:
   authelia:
     disabled: false
     displayname: "Authelia Admin"
-    password: "\$argon2id\$v=19\$m=65536,t=3,p=4\$ZBopMzXrzhHXPEZxRDVT2w\$SxWm96DwhOsZyn34DLocwQEIb4kCDsk632PuiMdZnig"
+    password: "${AUTHELIA_HASH}"
     groups: []
 EOF
 cat <<EOF >/etc/authelia/configuration.yml

install/firefly-install.sh

@@ -26,6 +26,7 @@ chown -R www-data:www-data /opt/firefly
 chmod -R 775 /opt/firefly/storage
 cd /opt/firefly
 cp .env.example .env
+sed -i -e "s|^APP_KEY=.*|APP_KEY=$(random_password 32)|" -e "s|^STATIC_CRON_TOKEN=.*|STATIC_CRON_TOKEN=$(random_password 32)|" /opt/firefly/.env
 sed -i "s/DB_HOST=.*/DB_HOST=localhost/" /opt/firefly/.env
 sed -i "s/DB_PASSWORD=.*/DB_PASSWORD=$MARIADB_DB_PASS/" /opt/firefly/.env
 $STD composer install --no-dev --no-plugins --no-interaction

install/homelable-install.sh

@@ -33,7 +33,13 @@ msg_ok "Set up Python Backend"
 msg_info "Configuring Homelable"
 mkdir -p /opt/homelable/data
 SECRET_KEY=$(openssl rand -hex 32)
-BCRYPT_HASH=$(/opt/homelable/backend/.venv/bin/python -c "import bcrypt; print(bcrypt.hashpw(b'admin', bcrypt.gensalt()).decode())")
+HOMELABLE_PASS=$(random_password 20)
+BCRYPT_HASH=$(/opt/homelable/backend/.venv/bin/python -c "import bcrypt,sys; print(bcrypt.hashpw(sys.argv[1].encode(), bcrypt.gensalt()).decode())" "$HOMELABLE_PASS")
+{
+  echo "Homelable Credentials"
+  echo "Username: admin"
+  echo "Password: ${HOMELABLE_PASS}"
+} >~/homelable.creds
 cat <<EOF >/opt/homelable/backend/.env
 SECRET_KEY=${SECRET_KEY}
 SQLITE_PATH=/opt/homelable/data/homelab.db

install/keycloak-install.sh

@@ -21,6 +21,7 @@ PG_DB_NAME="keycloak" PG_DB_USER="keycloak" setup_postgresql_db
 fetch_and_deploy_gh_release "keycloak_app" "keycloak/keycloak" "prebuild" "latest" "/opt/keycloak" "keycloak-*.tar.gz"
 
 msg_info "Creating Service"
+ADMIN_PASS=$(random_password 20)
 cat <<EOF >/etc/systemd/system/keycloak.service
 [Unit]
 Description=Keycloak Service
@@ -40,7 +41,7 @@ Environment="KC_DB_USERNAME=keycloak"
 Environment="KC_DB_PASSWORD=$PG_DB_PASS"
 Environment="KC_HTTP_ENABLED=true"
 Environment="KC_BOOTSTRAP_ADMIN_USERNAME=tmpadm"
-Environment="KC_BOOTSTRAP_ADMIN_PASSWORD=admin123"
+Environment="KC_BOOTSTRAP_ADMIN_PASSWORD=${ADMIN_PASS}"
 # Comment following line and uncomment the next 2 if working behind a reverse proxy
 Environment="KC_HOSTNAME_STRICT=false"
 #Environment="KC_HOSTNAME=keycloak.example.com"
@@ -48,6 +49,13 @@ Environment="KC_HOSTNAME_STRICT=false"
 [Install]
 WantedBy=multi-user.target
 EOF
+chmod 600 /etc/systemd/system/keycloak.service
+{
+  echo "Keycloak Credentials"
+  echo "Temporary admin, replace it with a permanent one"
+  echo "Username: tmpadm"
+  echo "Password: ${ADMIN_PASS}"
+} >~/keycloak.creds
 systemctl enable -q --now keycloak
 msg_ok "Created Service"
 

install/kimai-install.sh

@@ -40,6 +40,7 @@ cp .env.dist .env
 sed -i "/^DATABASE_URL=.*/c\DATABASE_URL=mysql://kimai:$MARIADB_DB_PASS@127.0.0.1:3306/kimai_db?charset=utf8mb4&serverVersion=mariadb-$MYSQL_VERSION" /opt/kimai/.env
 sed -i "s|^APP_SECRET=.*|APP_SECRET=$APP_SECRET|" /opt/kimai/.env
 $STD bin/console kimai:install -n
+ADMIN_PASS=$(random_password 20)
 $STD expect <<EOF
 set timeout -1
 log_user 0
@@ -47,10 +48,16 @@ log_user 0
 spawn bin/console kimai:user:create admin admin@community-scripts.org ROLE_SUPER_ADMIN
 
 expect "Please enter the password:"
-send "community-scripts.org\r"
+send "${ADMIN_PASS}\r"
 
 expect eof
 EOF
+{
+  echo "Kimai Credentials"
+  echo "Username: admin"
+  echo "Email: admin@community-scripts.org"
+  echo "Password: ${ADMIN_PASS}"
+} >~/kimai.creds
 $STD composer update --no-interaction
 cat <<EOF >/opt/kimai/config/packages/local.yaml
 kimai:

install/monica-install.sh

@@ -33,7 +33,13 @@ $STD yarn config set ignore-engines true
 $STD yarn install
 $STD yarn run production
 $STD php artisan key:generate
-$STD php artisan setup:production --email=admin@community-scripts.org --password=community-scripts.org --force
+ADMIN_PASS=$(random_password 20)
+$STD php artisan setup:production --email=admin@community-scripts.org --password="${ADMIN_PASS}" --force
+{
+  echo "Monica Credentials"
+  echo "Email: admin@community-scripts.org"
+  echo "Password: ${ADMIN_PASS}"
+} >~/monica.creds
 chown -R www-data:www-data /opt/monica
 chmod -R 775 /opt/monica/storage
 echo "* * * * * root php /opt/monica/artisan schedule:run >> /dev/null 2>&1" >>/etc/crontab

install/nagios-install.sh

@@ -63,7 +63,13 @@ setcap cap_net_raw+p /bin/ping
 msg_ok "Built Nagios Plugins"
 
 msg_info "Configuring Web Authentication"
-$STD htpasswd -bc /usr/local/nagios/etc/htpasswd.users nagiosadmin nagiosadmin
+NAGIOS_PASS=$(random_password 20)
+$STD htpasswd -bc /usr/local/nagios/etc/htpasswd.users nagiosadmin "$NAGIOS_PASS"
+{
+  echo "Nagios Credentials"
+  echo "Username: nagiosadmin"
+  echo "Password: ${NAGIOS_PASS}"
+} >~/nagios.creds
 chown root:www-data /usr/local/nagios/etc/htpasswd.users
 chmod 640 /usr/local/nagios/etc/htpasswd.users
 msg_ok "Configured Web Authentication"

install/neko-install.sh

@@ -201,6 +201,13 @@ cat <<'EOF' >/etc/neko/openbox.xml
 </openbox_config>
 EOF
 
+NEKO_ADMIN_PASS=$(random_password 20)
+NEKO_USER_PASS=$(random_password 20)
+{
+  echo "Neko Credentials"
+  echo "Admin password: ${NEKO_ADMIN_PASS}"
+  echo "User password: ${NEKO_USER_PASS}"
+} >~/neko.creds
 cat <<EOF >/etc/neko/neko.yaml
 server:
   bind: "0.0.0.0:8080"
@@ -219,8 +226,8 @@ desktop:
 member:
   provider: "multiuser"
   multiuser:
-    admin_password: "admin"
-    user_password: "neko"
+    admin_password: "${NEKO_ADMIN_PASS}"
+    user_password: "${NEKO_USER_PASS}"
 EOF
 msg_ok "Set up Runtime"
 

install/nodebb-install.sh

@@ -31,6 +31,7 @@ NODEBB_USER="nodebb"
 NODEBB_PWD="$(random_password 13)"
 MONGO_CONNECTION_STRING="mongodb://${NODEBB_USER}:${NODEBB_PWD}@localhost:27017/nodebb"
 NODEBB_SECRET=$(uuidgen)
+NODEBB_ADMIN_PASS="$(random_password 20)"
 cat <<EOF >~/nodebb.creds
 NodeBB-Credentials
 Mongo Database User: $MONGO_ADMIN_USER
@@ -38,6 +39,8 @@ Mongo Database Password: $MONGO_ADMIN_PWD
 NodeBB User: $NODEBB_USER
 NodeBB Password: $NODEBB_PWD
 NodeBB Secret: $NODEBB_SECRET
+NodeBB Admin User: community-scripts
+NodeBB Admin Password: $NODEBB_ADMIN_PASS
 EOF
 
 $STD mongosh <<EOF
@@ -97,10 +100,10 @@ expect "Administrator email address" {
     send "admin@community-scripts.org\r"
 }
 expect "Password" {
-    send "community-scripts\r"
+    send "$NODEBB_ADMIN_PASS\r"
 }
 expect "Confirm Password" {
-    send "community-scripts\r"
+    send "$NODEBB_ADMIN_PASS\r"
 }
 expect eof
 EOF

install/npmplus-install.sh

@@ -57,11 +57,17 @@ done
 ACME_EMAIL_INPUT="${var_npmplus_acme_email:-}"
 [[ -n "$ACME_EMAIL_INPUT" ]] || read -r -p "${TAB3}Enter your ACME Email (optional, press ENTER to skip): " ACME_EMAIL_INPUT || true
 
+ADMIN_PASS=$(random_password 20)
 yq -i "
   .services.npmplus.environment |=
     (map(select(. != \"TZ=*\" and . != \"ACME_EMAIL=*\" and . != \"INITIAL_ADMIN_EMAIL=*\" and . != \"INITIAL_ADMIN_PASSWORD=*\")) +
-    [\"TZ=$TZ_INPUT\", \"ACME_EMAIL=$ACME_EMAIL_INPUT\", \"INITIAL_ADMIN_EMAIL=admin@local.com\", \"INITIAL_ADMIN_PASSWORD=community-scripts.org\"])
+    [\"TZ=$TZ_INPUT\", \"ACME_EMAIL=$ACME_EMAIL_INPUT\", \"INITIAL_ADMIN_EMAIL=admin@local.com\", \"INITIAL_ADMIN_PASSWORD=${ADMIN_PASS}\"])
 " /opt/compose.yaml
+{
+  echo "NPMplus Credentials"
+  echo "Email: admin@local.com"
+  echo "Password: ${ADMIN_PASS}"
+} >~/npmplus.creds
 
 msg_info "Building and Starting NPMplus (Patience)"
 $STD docker compose up -d

install/octoprint-install.sh

@@ -30,7 +30,13 @@ rm -rf /usr/lib/python3.*/EXTERNALLY-MANAGED
 msg_ok "Setup Python3"
 
 msg_info "Creating user octoprint"
-useradd -m -s /bin/bash -p $(openssl passwd -1 octoprint) octoprint
+OCTOPRINT_PASS=$(random_password 20)
+useradd -m -s /bin/bash -p "$(openssl passwd -6 "$OCTOPRINT_PASS")" octoprint
+{
+  echo "OctoPrint Linux user Credentials"
+  echo "Username: octoprint"
+  echo "Password: ${OCTOPRINT_PASS}"
+} >~/octoprint.creds
 usermod -aG sudo,tty,dialout octoprint
 chown -R octoprint:octoprint /opt
 echo "octoprint ALL=NOPASSWD: $(command -v systemctl) restart octoprint, $(command -v reboot), $(command -v poweroff)" >/etc/sudoers.d/octoprint

install/paymenter-install.sh

@@ -43,7 +43,13 @@ $STD php artisan migrate --force --seed
 msg_ok "Set up database"
 
 msg_info "Creating Admin User"
-$STD php artisan app:user:create paymenter admin admin@paymenter.org paymenter 1 -q
+PAYMENTER_PASS=$(random_password 20)
+$STD php artisan app:user:create paymenter admin admin@paymenter.org "$PAYMENTER_PASS" 1 -q
+{
+  echo "Paymenter Credentials"
+  echo "Email: admin@paymenter.org"
+  echo "Password: ${PAYMENTER_PASS}"
+} >~/paymenter.creds
 msg_ok "Created Admin User"
 
 msg_info "Configuring Nginx"

install/photoprism-install.sh

@@ -46,10 +46,16 @@ tar -xzf /tmp/libheif.tar.gz -C /usr/local
 ldconfig
 echo "${LIBHEIF_URL}" >~/.photoprism_libheif
 chmod -R 755 /opt/photoprism/photos/originals
+ADMIN_PASS=$(random_password 20)
+{
+  echo "PhotoPrism Credentials"
+  echo "Username: admin"
+  echo "Password: ${ADMIN_PASS}"
+} >~/photoprism.creds
 cat <<EOF >/opt/photoprism/config/.env
 # Authentication
 PHOTOPRISM_ADMIN_USER='admin'
-PHOTOPRISM_ADMIN_PASSWORD='changeme'
+PHOTOPRISM_ADMIN_PASSWORD='${ADMIN_PASS}'
 PHOTOPRISM_AUTH_MODE='password'
 PHOTOPRISM_PUBLIC='false'
 
@@ -112,7 +118,7 @@ StoragePath: "/opt/photoprism/storage"
 OriginalsPath: "/opt/photoprism/photos/originals"
 ImportPath: "/media"
 AdminUser: "admin"
-AdminPassword: "changeme"
+AdminPassword: "${ADMIN_PASS}"
 AuthMode: "password"
 DatabaseDriver: "sqlite"
 HttpHost: "0.0.0.0"

install/qbittorrent-install.sh

@@ -18,12 +18,20 @@ fetch_and_deploy_gh_release "qbittorrent" "userdocs/qbittorrent-nox-static" "sin
 msg_info "Setup qBittorrent-nox"
 mv /opt/qbittorrent/qbittorrent /opt/qbittorrent/qbittorrent-nox
 mkdir -p ~/.config/qBittorrent/
+QB_PASS=$(random_password 20)
+QB_SALT=$(random_password 16)
+QB_HASH="$(printf '%s' "$QB_SALT" | base64 -w0):$(openssl kdf -keylen 64 -kdfopt digest:SHA512 -kdfopt pass:"$QB_PASS" -kdfopt salt:"$QB_SALT" -kdfopt iter:100000 -binary PBKDF2 | base64 -w0)"
+{
+  echo "qBittorrent Credentials"
+  echo "Username: admin"
+  echo "Password: ${QB_PASS}"
+} >~/qbittorrent.creds
 cat <<EOF >~/.config/qBittorrent/qBittorrent.conf
 [LegalNotice]
 Accepted=true
 
 [Preferences]
-WebUI\Password_PBKDF2="@ByteArray(amjeuVrF3xRbgzqWQmes5A==:XK3/Ra9jUmqUc4RwzCtrhrkQIcYczBl90DJw2rT8DFVTss4nxpoRhvyxhCf87ahVE3SzD8K9lyPdpyUCfmVsUg==)"
+WebUI\Password_PBKDF2="@ByteArray(${QB_HASH})"
 WebUI\Port=8090
 WebUI\UseUPnP=false
 WebUI\Username=admin

install/rabbitmq-install.sh

@@ -43,9 +43,15 @@ $STD rabbitmqctl enable_feature_flag all
 msg_ok "Enabled RabbitMQ Management Plugin"
 
 msg_info "Creating User"
-$STD rabbitmqctl add_user proxmox proxmox
+RABBITMQ_PASS=$(random_password 20)
+$STD rabbitmqctl add_user proxmox "$RABBITMQ_PASS"
 $STD rabbitmqctl set_user_tags proxmox administrator
 $STD rabbitmqctl set_permissions -p / proxmox ".*" ".*" ".*"
+{
+  echo "RabbitMQ Credentials"
+  echo "Username: proxmox"
+  echo "Password: ${RABBITMQ_PASS}"
+} >~/rabbitmq.creds
 msg_ok "Created User"
 
 motd_ssh

install/signoz-install.sh

@@ -151,7 +151,7 @@ INVITE_EMAIL_TEMPLATE=/opt/signoz/templates/invitation_email_template.html
 SIGNOZ_SQLSTORE_SQLITE_PATH=/var/lib/signoz/signoz.db
 SIGNOZ_WEB_ENABLED=true
 SIGNOZ_WEB_DIRECTORY=/opt/signoz/web
-SIGNOZ_JWT_SECRET=secret
+SIGNOZ_JWT_SECRET=$(openssl rand -hex 32)
 SIGNOZ_ALERTMANAGER_PROVIDER=signoz
 SIGNOZ_TELEMETRYSTORE_PROVIDER=clickhouse
 SIGNOZ_TELEMETRYSTORE_CLICKHOUSE_DSN=tcp://localhost:9000?password=

install/snapotter-install.sh

@@ -78,6 +78,12 @@ msg_info "Configuring SnapOtter"
 mkdir -p /opt/snapotter_data/files
 mkdir -p /tmp/snapotter-workspace
 
+SNAPOTTER_PASS=$(random_password 20)
+{
+  echo "SnapOtter Credentials"
+  echo "Username: admin"
+  echo "Password: ${SNAPOTTER_PASS}"
+} >~/snapotter.creds
 cat <<EOF >/opt/snapotter_data/.env
 PORT=1349
 NODE_ENV=production
@@ -92,7 +98,7 @@ FEATURE_MANIFEST_PATH=/opt/snapotter/docker/feature-manifest.json
 U2NET_HOME=/opt/snapotter_data/ai/models/rembg
 AUTH_ENABLED=true
 DEFAULT_USERNAME=admin
-DEFAULT_PASSWORD=admin
+DEFAULT_PASSWORD=${SNAPOTTER_PASS}
 LOG_LEVEL=info
 TRUST_PROXY=true
 FILE_MAX_AGE_HOURS=72

install/stirling-pdf-install.sh

@@ -116,10 +116,6 @@ if [[ "$login_mode" == "true" ]]; then
 # activate Login
 DISABLE_ADDITIONAL_FEATURES=false
 SECURITY_ENABLELOGIN=true
-
-# login credentials
-SECURITY_INITIALLOGIN_USERNAME=admin
-SECURITY_INITIALLOGIN_PASSWORD=stirling
 EOF
 fi
 msg_ok "Created Environment Variables"

tools/addon/coder-code-server.sh

@@ -85,12 +85,16 @@ function install() {
   mkdir -p "${HOME}/.config/code-server/"
 
   if [ "$preexisting_config" = false ]; then
+    CS_PASS=$(random_password 20)
     cat <<EOF >"$config_path"
 bind-addr: 0.0.0.0:8680
-auth: none
-password: 
+auth: password
+password: ${CS_PASS}
 cert: false
 EOF
+    chmod 600 "$config_path"
+    echo -e "Coder Code Server\nPassword: ${CS_PASS}" >~/coder-code-server.creds
+    chmod 600 ~/coder-code-server.creds
   fi
   systemctl enable -q --now code-server@"$USER"
   systemctl restart code-server@"$USER"
@@ -111,7 +115,7 @@ EOF
   msg_ok "Created update script (/usr/local/bin/update_coder-code-server)"
 
   echo -e "${APP} should be reachable by going to the following URL.
-         ${BL}http://${IP}:8680${CL} \n"
+         ${BL}http://${IP}:8680${CL} (password in ~/coder-code-server.creds)\n"
 }
 
 # ==============================================================================

tools/addon/copyparty.sh

@@ -151,9 +151,9 @@ function install() {
   else
     read -rp "${TAB}Set admin username [admin]: " admin_user
     admin_user=${admin_user:-admin}
-    read -rsp "${TAB}Set admin password [community-scripts.org]: " admin_pass
+    read -rsp "${TAB}Set admin password [random]: " admin_pass
     echo ""
-    admin_pass=${admin_pass:-community-scripts.org}
+    admin_pass=${admin_pass:-$(random_password 20)}
     msg_ok "Configured with admin user: ${admin_user}"
   fi
 
@@ -291,8 +291,10 @@ UPDATEEOF
   msg_ok "Storage: ${BL}${DATA_PATH}${CL}"
   msg_ok "Config: ${BL}${CONF_PATH}${CL}"
   if [[ -n "$admin_user" ]]; then
+    echo -e "Copyparty\nUsername: ${admin_user}\nPassword: ${admin_pass}" >~/copyparty.creds
+    chmod 600 ~/copyparty.creds
     echo ""
-    msg_ok "Login: ${GN}${admin_user}${CL} / ${GN}${admin_pass}${CL}"
+    msg_ok "Login: ${GN}${admin_user}${CL} (password in ~/copyparty.creds)"
   fi
 }
 

tools/addon/filebrowser-quantum.sh

@@ -189,6 +189,8 @@ chown root:root /usr/local/community-scripts
 chmod 755 /usr/local/community-scripts
 msg_ok "Directory prepared"
 
+ADMIN_PASS=$(random_password 20)
+msg_warn "FileBrowser runs as root and shows the whole filesystem. Without authentication, anyone who reaches port ${PORT} can read and change every file."
 echo -n "${TAB}Use No Authentication? (y/N): "
 read -r noauth_prompt
 
@@ -234,9 +236,12 @@ server:
           - neverWatchPath: "/lost+found"
 auth:
   adminUsername: admin
-  adminPassword: community-scripts.org
+  adminPassword: ${ADMIN_PASS}
 EOF
-  msg_ok "Configured with default admin (admin / community-scripts.org)"
+  chmod 600 "$CONFIG_PATH"
+  echo -e "FileBrowser Quantum\nUsername: admin\nPassword: ${ADMIN_PASS}" >~/filebrowser-quantum.creds
+  chmod 600 ~/filebrowser-quantum.creds
+  msg_ok "Configured admin (credentials saved in ~/filebrowser-quantum.creds)"
 fi
 
 msg_info "Creating service"
@@ -276,4 +281,13 @@ EOF
 fi
 
 msg_ok "Service created successfully"
+
+# auth.adminPassword resets the password on every start, so it stays only until the admin exists
+if grep -q '^\s*adminPassword:' "$CONFIG_PATH"; then
+  for _ in {1..30}; do
+    [[ "$(curl -s -o /dev/null -w '%{http_code}' "http://127.0.0.1:${PORT}/health")" == "200" ]] && break
+    sleep 1
+  done
+  sed -i '/^\s*adminPassword:/d' "$CONFIG_PATH"
+fi
 msg_ok "${APP} is reachable at: ${BL}http://${IP}:${PORT}${CL}"

tools/addon/filebrowser.sh

@@ -122,9 +122,11 @@ if [[ "${install_prompt,,}" =~ ^(y|yes)$ ]]; then
   chmod 755 /usr/local/community-scripts
   touch "$DB_PATH"
   chown root:root "$DB_PATH"
-  chmod 644 "$DB_PATH"
+  chmod 600 "$DB_PATH"
   msg_ok "Directory created successfully"
 
+  ADMIN_PASS=$(random_password 20)
+  msg_warn "FileBrowser runs as root and shows the whole filesystem. Without authentication, anyone who reaches port ${PORT} can read and change every file."
   read -r -p "Would you like to use No Authentication? (y/N): " auth_prompt
   if [[ "${auth_prompt,,}" =~ ^(y|yes)$ ]]; then
     msg_info "Configuring No Authentication"
@@ -133,16 +135,18 @@ if [[ "${install_prompt,,}" =~ ^(y|yes)$ ]]; then
     $STD filebrowser config set -a '0.0.0.0' -p "$PORT" -d "$DB_PATH"
     $STD filebrowser config set --auth.method=noauth --database "$DB_PATH"
     if ! filebrowser users update 1 --perm.admin --database "$DB_PATH" &>/dev/null; then
-      $STD filebrowser users add admin community-scripts.org --perm.admin --database "$DB_PATH"
+      $STD filebrowser users add admin "$ADMIN_PASS" --perm.admin --database "$DB_PATH"
     fi
     msg_ok "No Authentication configured"
   else
-    msg_info "Setting up default authentication"
+    msg_info "Setting up authentication"
     cd /usr/local/community-scripts
     $STD filebrowser config init -a '0.0.0.0' -p "$PORT" -d "$DB_PATH"
     $STD filebrowser config set -a '0.0.0.0' -p "$PORT" -d "$DB_PATH"
-    $STD filebrowser users add admin community-scripts.org --perm.admin --database "$DB_PATH"
-    msg_ok "Default authentication configured (admin:community-scripts.org)"
+    $STD filebrowser users add admin "$ADMIN_PASS" --perm.admin --database "$DB_PATH"
+    echo -e "FileBrowser\nUsername: admin\nPassword: ${ADMIN_PASS}" >~/filebrowser.creds
+    chmod 600 ~/filebrowser.creds
+    msg_ok "Authentication configured (credentials saved in ~/filebrowser.creds)"
   fi
 
   msg_info "Creating service"
@@ -156,7 +160,6 @@ After=network-online.target
 User=root
 WorkingDirectory=/usr/local/community-scripts
 ExecStartPre=/bin/touch /usr/local/community-scripts/filebrowser.db
-ExecStartPre=/usr/local/bin/filebrowser config set -a "0.0.0.0" -p ${PORT} -d /usr/local/community-scripts/filebrowser.db
 ExecStart=/usr/local/bin/filebrowser -r / -d /usr/local/community-scripts/filebrowser.db -p ${PORT}
 Restart=always
 

tools/addon/webmin.sh

@@ -30,6 +30,7 @@ catch_errors
 
 # Initialize all core functions (colors, formatting, icons, STD mode)
 load_functions
+confirm_not_pve_host
 require_debian_like
 
 header_info
@@ -49,9 +50,13 @@ msg_ok "Installed Prerequisites"
 
 msg_info "Installing ${APP}"
 fetch_and_deploy_gh_release "webmin" "webmin/webmin" "binary" "latest" "/opt/webmin" "webmin_*_all.deb"
-/usr/share/webmin/changepass.pl /etc/webmin root root &>/dev/null
+WEBMIN_PASS=$(random_password 20)
+/usr/share/webmin/changepass.pl /etc/webmin root "$WEBMIN_PASS" &>/dev/null
+echo -e "Webmin\nUsername: root\nPassword: ${WEBMIN_PASS}" >~/webmin.creds
+chmod 600 ~/webmin.creds
 msg_ok "Installed ${APP}"
 
 get_lxc_ip
 echo -e "Successfully Installed!! ${APP} should be reachable by going to ${BL}https://${LOCAL_IP}:10000${CL}"
+echo -e "Login: root, password in ~/webmin.creds"