fix: generate first logins and secrets instead of fixed ones in 13 more installs

authelia, qbittorrent, rabbitmq, nagios, neko, paymenter, nodebb, homelable, snapotter and octoprint's Linux user were created with fixed passwords; each now uses random_password and saves the login in ~/<app>.creds. Stirling-PDF no longer sets admin/stirling explicitly, so its own default asks for a new password on first login again. Firefly kept the example APP_KEY and STATIC_CRON_TOKEN, and SigNoz used the JWT secret "secret"; both are generated now. Only new installs change.

ct/homeassistant.sh

@@ -70,32 +70,7 @@ function update_script() {
     exit
   fi
   if [ "$UPD" == "4" ]; then
-    msg_info "Installing FileBrowser"
+    bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/tools/addon/filebrowser.sh)"
-    RELEASE=$(curl -fsSL https://api.github.com/repos/filebrowser/filebrowser/releases/latest | grep -o '"tag_name": ".*"' | sed 's/"//g' | sed 's/tag_name: //g')
-    $STD curl -fsSL https://github.com/filebrowser/filebrowser/releases/download/v2.23.0/linux-$(arch_resolve)-filebrowser.tar.gz | tar -xzv -C /usr/local/bin
-    $STD filebrowser config init -a '0.0.0.0'
-    $STD filebrowser config set -a '0.0.0.0'
-    $STD filebrowser users add admin community-scripts.org --perm.admin
-    msg_ok "Installed FileBrowser"
-
-    msg_info "Creating Service"
-    service_path="/etc/systemd/system/filebrowser.service"
-    echo "[Unit]
-Description=Filebrowser
-After=network-online.target
-[Service]
-User=root
-WorkingDirectory=/root/
-ExecStart=/usr/local/bin/filebrowser -r /
-[Install]
-WantedBy=default.target" >$service_path
-
-    $STD systemctl enable --now filebrowser
-    msg_ok "Created Service"
-
-    msg_ok "Completed successfully!\n"
-    echo -e "FileBrowser should be reachable by going to the following URL.
-         ${BL}http://$LOCAL_IP:8080${CL}   admin|community-scripts.org\n"
     exit
   fi
 }

ct/podman-homeassistant.sh

@@ -66,33 +66,7 @@ function update_script() {
     exit
   fi
   if [ "$UPD" == "3" ]; then
-    msg_info "Installing FileBrowser"
+    bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/tools/addon/filebrowser.sh)"
-    $STD curl -fsSL https://raw.githubusercontent.com/filebrowser/get/master/get.sh | bash
-    $STD filebrowser config init -a '0.0.0.0'
-    $STD filebrowser config set -a '0.0.0.0'
-    $STD filebrowser users add admin community-scripts.org --perm.admin
-    msg_ok "Installed FileBrowser"
-
-    msg_info "Creating Service"
-    cat <<EOF >/etc/systemd/system/filebrowser.service
-[Unit]
-Description=Filebrowser
-After=network-online.target
-
-[Service]
-User=root
-WorkingDirectory=/root/
-ExecStart=/usr/local/bin/filebrowser -r /
-
-[Install]
-WantedBy=default.target
-EOF
-    systemctl enable -q --now filebrowser
-    msg_ok "Created Service"
-
-    msg_ok "Completed successfully!\n"
-    echo -e "FileBrowser should be reachable by going to the following URL.
-         ${BL}http://$LOCAL_IP:8080${CL}   admin|community-scripts.org\n"
     exit
   fi
   if [ "$UPD" == "4" ]; then

install/archivebox-install.sh

@@ -48,6 +48,7 @@ chown -R archivebox:archivebox /opt/archivebox/{data,.npm,.cache,.local}
 chmod -R 755 /opt/archivebox/data
 $STD uv pip install archivebox --system --break-system-packages
 cd /opt/archivebox/data
+ADMIN_PASS=$(random_password 20)
 expect <<EOF
 set timeout -1
 log_user 0
@@ -62,13 +63,18 @@ expect "Email address"
 send "\r"
 
 expect "Password"
-send "community-scripts.org\r"
+send "${ADMIN_PASS}\r"
 
 expect "Password (again)"
-send "community-scripts.org\r"
+send "${ADMIN_PASS}\r"
 
 expect eof
 EOF
+{
+  echo "ArchiveBox Credentials"
+  echo "Username: archivebox"
+  echo "Password: ${ADMIN_PASS}"
+} >~/archivebox.creds
 msg_ok "Installed ArchiveBox"
 
 msg_info "Creating Service"

install/authelia-install.sh

@@ -63,12 +63,19 @@ else
 fi
 echo "$AUTHELIA_URL" >/etc/authelia/.authelia_url
 
+AUTHELIA_PASS=$(random_password 20)
+AUTHELIA_HASH=$(authelia crypto hash generate argon2 --password "$AUTHELIA_PASS" | awk '/Digest:/{print $2}')
+{
+  echo "Authelia Credentials"
+  echo "Username: authelia"
+  echo "Password: ${AUTHELIA_PASS}"
+} >~/authelia.creds
 cat <<EOF >/etc/authelia/users.yml
 users:
   authelia:
     disabled: false
     displayname: "Authelia Admin"
-    password: "\$argon2id\$v=19\$m=65536,t=3,p=4\$ZBopMzXrzhHXPEZxRDVT2w\$SxWm96DwhOsZyn34DLocwQEIb4kCDsk632PuiMdZnig"
+    password: "${AUTHELIA_HASH}"
     groups: []
 EOF
 cat <<EOF >/etc/authelia/configuration.yml

install/firefly-install.sh

@@ -26,6 +26,7 @@ chown -R www-data:www-data /opt/firefly
 chmod -R 775 /opt/firefly/storage
 cd /opt/firefly
 cp .env.example .env
+sed -i -e "s|^APP_KEY=.*|APP_KEY=$(random_password 32)|" -e "s|^STATIC_CRON_TOKEN=.*|STATIC_CRON_TOKEN=$(random_password 32)|" /opt/firefly/.env
 sed -i "s/DB_HOST=.*/DB_HOST=localhost/" /opt/firefly/.env
 sed -i "s/DB_PASSWORD=.*/DB_PASSWORD=$MARIADB_DB_PASS/" /opt/firefly/.env
 $STD composer install --no-dev --no-plugins --no-interaction

install/homelable-install.sh

@@ -33,7 +33,13 @@ msg_ok "Set up Python Backend"
 msg_info "Configuring Homelable"
 mkdir -p /opt/homelable/data
 SECRET_KEY=$(openssl rand -hex 32)
-BCRYPT_HASH=$(/opt/homelable/backend/.venv/bin/python -c "import bcrypt; print(bcrypt.hashpw(b'admin', bcrypt.gensalt()).decode())")
+HOMELABLE_PASS=$(random_password 20)
+BCRYPT_HASH=$(/opt/homelable/backend/.venv/bin/python -c "import bcrypt,sys; print(bcrypt.hashpw(sys.argv[1].encode(), bcrypt.gensalt()).decode())" "$HOMELABLE_PASS")
+{
+  echo "Homelable Credentials"
+  echo "Username: admin"
+  echo "Password: ${HOMELABLE_PASS}"
+} >~/homelable.creds
 cat <<EOF >/opt/homelable/backend/.env
 SECRET_KEY=${SECRET_KEY}
 SQLITE_PATH=/opt/homelable/data/homelab.db

install/keycloak-install.sh

@@ -21,6 +21,7 @@ PG_DB_NAME="keycloak" PG_DB_USER="keycloak" setup_postgresql_db
 fetch_and_deploy_gh_release "keycloak_app" "keycloak/keycloak" "prebuild" "latest" "/opt/keycloak" "keycloak-*.tar.gz"
 
 msg_info "Creating Service"
+ADMIN_PASS=$(random_password 20)
 cat <<EOF >/etc/systemd/system/keycloak.service
 [Unit]
 Description=Keycloak Service
@@ -40,7 +41,7 @@ Environment="KC_DB_USERNAME=keycloak"
 Environment="KC_DB_PASSWORD=$PG_DB_PASS"
 Environment="KC_HTTP_ENABLED=true"
 Environment="KC_BOOTSTRAP_ADMIN_USERNAME=tmpadm"
-Environment="KC_BOOTSTRAP_ADMIN_PASSWORD=admin123"
+Environment="KC_BOOTSTRAP_ADMIN_PASSWORD=${ADMIN_PASS}"
 # Comment following line and uncomment the next 2 if working behind a reverse proxy
 Environment="KC_HOSTNAME_STRICT=false"
 #Environment="KC_HOSTNAME=keycloak.example.com"
@@ -48,6 +49,13 @@ Environment="KC_HOSTNAME_STRICT=false"
 [Install]
 WantedBy=multi-user.target
 EOF
+chmod 600 /etc/systemd/system/keycloak.service
+{
+  echo "Keycloak Credentials"
+  echo "Temporary admin, replace it with a permanent one"
+  echo "Username: tmpadm"
+  echo "Password: ${ADMIN_PASS}"
+} >~/keycloak.creds
 systemctl enable -q --now keycloak
 msg_ok "Created Service"
 

install/kimai-install.sh

@@ -40,6 +40,7 @@ cp .env.dist .env
 sed -i "/^DATABASE_URL=.*/c\DATABASE_URL=mysql://kimai:$MARIADB_DB_PASS@127.0.0.1:3306/kimai_db?charset=utf8mb4&serverVersion=mariadb-$MYSQL_VERSION" /opt/kimai/.env
 sed -i "s|^APP_SECRET=.*|APP_SECRET=$APP_SECRET|" /opt/kimai/.env
 $STD bin/console kimai:install -n
+ADMIN_PASS=$(random_password 20)
 $STD expect <<EOF
 set timeout -1
 log_user 0
@@ -47,10 +48,16 @@ log_user 0
 spawn bin/console kimai:user:create admin admin@community-scripts.org ROLE_SUPER_ADMIN
 
 expect "Please enter the password:"
-send "community-scripts.org\r"
+send "${ADMIN_PASS}\r"
 
 expect eof
 EOF
+{
+  echo "Kimai Credentials"
+  echo "Username: admin"
+  echo "Email: admin@community-scripts.org"
+  echo "Password: ${ADMIN_PASS}"
+} >~/kimai.creds
 $STD composer update --no-interaction
 cat <<EOF >/opt/kimai/config/packages/local.yaml
 kimai:

install/monica-install.sh

@@ -33,7 +33,13 @@ $STD yarn config set ignore-engines true
 $STD yarn install
 $STD yarn run production
 $STD php artisan key:generate
-$STD php artisan setup:production --email=admin@community-scripts.org --password=community-scripts.org --force
+ADMIN_PASS=$(random_password 20)
+$STD php artisan setup:production --email=admin@community-scripts.org --password="${ADMIN_PASS}" --force
+{
+  echo "Monica Credentials"
+  echo "Email: admin@community-scripts.org"
+  echo "Password: ${ADMIN_PASS}"
+} >~/monica.creds
 chown -R www-data:www-data /opt/monica
 chmod -R 775 /opt/monica/storage
 echo "* * * * * root php /opt/monica/artisan schedule:run >> /dev/null 2>&1" >>/etc/crontab

install/nagios-install.sh

@@ -63,7 +63,13 @@ setcap cap_net_raw+p /bin/ping
 msg_ok "Built Nagios Plugins"
 
 msg_info "Configuring Web Authentication"
-$STD htpasswd -bc /usr/local/nagios/etc/htpasswd.users nagiosadmin nagiosadmin
+NAGIOS_PASS=$(random_password 20)
+$STD htpasswd -bc /usr/local/nagios/etc/htpasswd.users nagiosadmin "$NAGIOS_PASS"
+{
+  echo "Nagios Credentials"
+  echo "Username: nagiosadmin"
+  echo "Password: ${NAGIOS_PASS}"
+} >~/nagios.creds
 chown root:www-data /usr/local/nagios/etc/htpasswd.users
 chmod 640 /usr/local/nagios/etc/htpasswd.users
 msg_ok "Configured Web Authentication"

install/neko-install.sh

@@ -201,6 +201,13 @@ cat <<'EOF' >/etc/neko/openbox.xml
 </openbox_config>
 EOF
 
+NEKO_ADMIN_PASS=$(random_password 20)
+NEKO_USER_PASS=$(random_password 20)
+{
+  echo "Neko Credentials"
+  echo "Admin password: ${NEKO_ADMIN_PASS}"
+  echo "User password: ${NEKO_USER_PASS}"
+} >~/neko.creds
 cat <<EOF >/etc/neko/neko.yaml
 server:
   bind: "0.0.0.0:8080"
@@ -219,8 +226,8 @@ desktop:
 member:
   provider: "multiuser"
   multiuser:
-    admin_password: "admin"
+    admin_password: "${NEKO_ADMIN_PASS}"
-    user_password: "neko"
+    user_password: "${NEKO_USER_PASS}"
 EOF
 msg_ok "Set up Runtime"
 

install/nodebb-install.sh

@@ -31,6 +31,7 @@ NODEBB_USER="nodebb"
 NODEBB_PWD="$(random_password 13)"
 MONGO_CONNECTION_STRING="mongodb://${NODEBB_USER}:${NODEBB_PWD}@localhost:27017/nodebb"
 NODEBB_SECRET=$(uuidgen)
+NODEBB_ADMIN_PASS="$(random_password 20)"
 cat <<EOF >~/nodebb.creds
 NodeBB-Credentials
 Mongo Database User: $MONGO_ADMIN_USER
@@ -38,6 +39,8 @@ Mongo Database Password: $MONGO_ADMIN_PWD
 NodeBB User: $NODEBB_USER
 NodeBB Password: $NODEBB_PWD
 NodeBB Secret: $NODEBB_SECRET
+NodeBB Admin User: community-scripts
+NodeBB Admin Password: $NODEBB_ADMIN_PASS
 EOF
 
 $STD mongosh <<EOF
@@ -97,10 +100,10 @@ expect "Administrator email address" {
     send "admin@community-scripts.org\r"
 }
 expect "Password" {
-    send "community-scripts\r"
+    send "$NODEBB_ADMIN_PASS\r"
 }
 expect "Confirm Password" {
-    send "community-scripts\r"
+    send "$NODEBB_ADMIN_PASS\r"
 }
 expect eof
 EOF

install/npmplus-install.sh

@@ -57,11 +57,17 @@ done
 ACME_EMAIL_INPUT="${var_npmplus_acme_email:-}"
 [[ -n "$ACME_EMAIL_INPUT" ]] || read -r -p "${TAB3}Enter your ACME Email (optional, press ENTER to skip): " ACME_EMAIL_INPUT || true
 
+ADMIN_PASS=$(random_password 20)
 yq -i "
   .services.npmplus.environment |=
     (map(select(. != \"TZ=*\" and . != \"ACME_EMAIL=*\" and . != \"INITIAL_ADMIN_EMAIL=*\" and . != \"INITIAL_ADMIN_PASSWORD=*\")) +
-    [\"TZ=$TZ_INPUT\", \"ACME_EMAIL=$ACME_EMAIL_INPUT\", \"INITIAL_ADMIN_EMAIL=admin@local.com\", \"INITIAL_ADMIN_PASSWORD=community-scripts.org\"])
+    [\"TZ=$TZ_INPUT\", \"ACME_EMAIL=$ACME_EMAIL_INPUT\", \"INITIAL_ADMIN_EMAIL=admin@local.com\", \"INITIAL_ADMIN_PASSWORD=${ADMIN_PASS}\"])
 " /opt/compose.yaml
+{
+  echo "NPMplus Credentials"
+  echo "Email: admin@local.com"
+  echo "Password: ${ADMIN_PASS}"
+} >~/npmplus.creds
 
 msg_info "Building and Starting NPMplus (Patience)"
 $STD docker compose up -d

install/octoprint-install.sh

@@ -30,7 +30,13 @@ rm -rf /usr/lib/python3.*/EXTERNALLY-MANAGED
 msg_ok "Setup Python3"
 
 msg_info "Creating user octoprint"
-useradd -m -s /bin/bash -p $(openssl passwd -1 octoprint) octoprint
+OCTOPRINT_PASS=$(random_password 20)
+useradd -m -s /bin/bash -p "$(openssl passwd -6 "$OCTOPRINT_PASS")" octoprint
+{
+  echo "OctoPrint Linux user Credentials"
+  echo "Username: octoprint"
+  echo "Password: ${OCTOPRINT_PASS}"
+} >~/octoprint.creds
 usermod -aG sudo,tty,dialout octoprint
 chown -R octoprint:octoprint /opt
 echo "octoprint ALL=NOPASSWD: $(command -v systemctl) restart octoprint, $(command -v reboot), $(command -v poweroff)" >/etc/sudoers.d/octoprint

install/paymenter-install.sh

@@ -43,7 +43,13 @@ $STD php artisan migrate --force --seed
 msg_ok "Set up database"
 
 msg_info "Creating Admin User"
-$STD php artisan app:user:create paymenter admin admin@paymenter.org paymenter 1 -q
+PAYMENTER_PASS=$(random_password 20)
+$STD php artisan app:user:create paymenter admin admin@paymenter.org "$PAYMENTER_PASS" 1 -q
+{
+  echo "Paymenter Credentials"
+  echo "Email: admin@paymenter.org"
+  echo "Password: ${PAYMENTER_PASS}"
+} >~/paymenter.creds
 msg_ok "Created Admin User"
 
 msg_info "Configuring Nginx"

install/photoprism-install.sh

@@ -46,10 +46,16 @@ tar -xzf /tmp/libheif.tar.gz -C /usr/local
 ldconfig
 echo "${LIBHEIF_URL}" >~/.photoprism_libheif
 chmod -R 755 /opt/photoprism/photos/originals
+ADMIN_PASS=$(random_password 20)
+{
+  echo "PhotoPrism Credentials"
+  echo "Username: admin"
+  echo "Password: ${ADMIN_PASS}"
+} >~/photoprism.creds
 cat <<EOF >/opt/photoprism/config/.env
 # Authentication
 PHOTOPRISM_ADMIN_USER='admin'
-PHOTOPRISM_ADMIN_PASSWORD='changeme'
+PHOTOPRISM_ADMIN_PASSWORD='${ADMIN_PASS}'
 PHOTOPRISM_AUTH_MODE='password'
 PHOTOPRISM_PUBLIC='false'
 
@@ -112,7 +118,7 @@ StoragePath: "/opt/photoprism/storage"
 OriginalsPath: "/opt/photoprism/photos/originals"
 ImportPath: "/media"
 AdminUser: "admin"
-AdminPassword: "changeme"
+AdminPassword: "${ADMIN_PASS}"
 AuthMode: "password"
 DatabaseDriver: "sqlite"
 HttpHost: "0.0.0.0"

install/qbittorrent-install.sh

@@ -18,12 +18,20 @@ fetch_and_deploy_gh_release "qbittorrent" "userdocs/qbittorrent-nox-static" "sin
 msg_info "Setup qBittorrent-nox"
 mv /opt/qbittorrent/qbittorrent /opt/qbittorrent/qbittorrent-nox
 mkdir -p ~/.config/qBittorrent/
+QB_PASS=$(random_password 20)
+QB_SALT=$(random_password 16)
+QB_HASH="$(printf '%s' "$QB_SALT" | base64 -w0):$(openssl kdf -keylen 64 -kdfopt digest:SHA512 -kdfopt pass:"$QB_PASS" -kdfopt salt:"$QB_SALT" -kdfopt iter:100000 -binary PBKDF2 | base64 -w0)"
+{
+  echo "qBittorrent Credentials"
+  echo "Username: admin"
+  echo "Password: ${QB_PASS}"
+} >~/qbittorrent.creds
 cat <<EOF >~/.config/qBittorrent/qBittorrent.conf
 [LegalNotice]
 Accepted=true
 
 [Preferences]
-WebUI\Password_PBKDF2="@ByteArray(amjeuVrF3xRbgzqWQmes5A==:XK3/Ra9jUmqUc4RwzCtrhrkQIcYczBl90DJw2rT8DFVTss4nxpoRhvyxhCf87ahVE3SzD8K9lyPdpyUCfmVsUg==)"
+WebUI\Password_PBKDF2="@ByteArray(${QB_HASH})"
 WebUI\Port=8090
 WebUI\UseUPnP=false
 WebUI\Username=admin

install/rabbitmq-install.sh

@@ -43,9 +43,15 @@ $STD rabbitmqctl enable_feature_flag all
 msg_ok "Enabled RabbitMQ Management Plugin"
 
 msg_info "Creating User"
-$STD rabbitmqctl add_user proxmox proxmox
+RABBITMQ_PASS=$(random_password 20)
+$STD rabbitmqctl add_user proxmox "$RABBITMQ_PASS"
 $STD rabbitmqctl set_user_tags proxmox administrator
 $STD rabbitmqctl set_permissions -p / proxmox ".*" ".*" ".*"
+{
+  echo "RabbitMQ Credentials"
+  echo "Username: proxmox"
+  echo "Password: ${RABBITMQ_PASS}"
+} >~/rabbitmq.creds
 msg_ok "Created User"
 
 motd_ssh

install/signoz-install.sh

@@ -151,7 +151,7 @@ INVITE_EMAIL_TEMPLATE=/opt/signoz/templates/invitation_email_template.html
 SIGNOZ_SQLSTORE_SQLITE_PATH=/var/lib/signoz/signoz.db
 SIGNOZ_WEB_ENABLED=true
 SIGNOZ_WEB_DIRECTORY=/opt/signoz/web
-SIGNOZ_JWT_SECRET=secret
+SIGNOZ_JWT_SECRET=$(openssl rand -hex 32)
 SIGNOZ_ALERTMANAGER_PROVIDER=signoz
 SIGNOZ_TELEMETRYSTORE_PROVIDER=clickhouse
 SIGNOZ_TELEMETRYSTORE_CLICKHOUSE_DSN=tcp://localhost:9000?password=

install/snapotter-install.sh

@@ -78,6 +78,12 @@ msg_info "Configuring SnapOtter"
 mkdir -p /opt/snapotter_data/files
 mkdir -p /tmp/snapotter-workspace
 
+SNAPOTTER_PASS=$(random_password 20)
+{
+  echo "SnapOtter Credentials"
+  echo "Username: admin"
+  echo "Password: ${SNAPOTTER_PASS}"
+} >~/snapotter.creds
 cat <<EOF >/opt/snapotter_data/.env
 PORT=1349
 NODE_ENV=production
@@ -92,7 +98,7 @@ FEATURE_MANIFEST_PATH=/opt/snapotter/docker/feature-manifest.json
 U2NET_HOME=/opt/snapotter_data/ai/models/rembg
 AUTH_ENABLED=true
 DEFAULT_USERNAME=admin
-DEFAULT_PASSWORD=admin
+DEFAULT_PASSWORD=${SNAPOTTER_PASS}
 LOG_LEVEL=info
 TRUST_PROXY=true
 FILE_MAX_AGE_HOURS=72

install/stirling-pdf-install.sh

@@ -116,10 +116,6 @@ if [[ "$login_mode" == "true" ]]; then
 # activate Login
 DISABLE_ADDITIONAL_FEATURES=false
 SECURITY_ENABLELOGIN=true
-
-# login credentials
-SECURITY_INITIALLOGIN_USERNAME=admin
-SECURITY_INITIALLOGIN_PASSWORD=stirling
 EOF
 fi
 msg_ok "Created Environment Variables"

tools/addon/coder-code-server.sh

@@ -85,12 +85,16 @@ function install() {
   mkdir -p "${HOME}/.config/code-server/"
 
   if [ "$preexisting_config" = false ]; then
+    CS_PASS=$(random_password 20)
     cat <<EOF >"$config_path"
 bind-addr: 0.0.0.0:8680
-auth: none
+auth: password
-password: 
+password: ${CS_PASS}
 cert: false
 EOF
+    chmod 600 "$config_path"
+    echo -e "Coder Code Server\nPassword: ${CS_PASS}" >~/coder-code-server.creds
+    chmod 600 ~/coder-code-server.creds
   fi
   systemctl enable -q --now code-server@"$USER"
   systemctl restart code-server@"$USER"
@@ -111,7 +115,7 @@ EOF
   msg_ok "Created update script (/usr/local/bin/update_coder-code-server)"
 
   echo -e "${APP} should be reachable by going to the following URL.
-         ${BL}http://${IP}:8680${CL} \n"
+         ${BL}http://${IP}:8680${CL} (password in ~/coder-code-server.creds)\n"
 }
 
 # ==============================================================================

tools/addon/copyparty.sh

@@ -151,9 +151,9 @@ function install() {
   else
     read -rp "${TAB}Set admin username [admin]: " admin_user
     admin_user=${admin_user:-admin}
-    read -rsp "${TAB}Set admin password [community-scripts.org]: " admin_pass
+    read -rsp "${TAB}Set admin password [random]: " admin_pass
     echo ""
-    admin_pass=${admin_pass:-community-scripts.org}
+    admin_pass=${admin_pass:-$(random_password 20)}
     msg_ok "Configured with admin user: ${admin_user}"
   fi
 
@@ -291,8 +291,10 @@ UPDATEEOF
   msg_ok "Storage: ${BL}${DATA_PATH}${CL}"
   msg_ok "Config: ${BL}${CONF_PATH}${CL}"
   if [[ -n "$admin_user" ]]; then
+    echo -e "Copyparty\nUsername: ${admin_user}\nPassword: ${admin_pass}" >~/copyparty.creds
+    chmod 600 ~/copyparty.creds
     echo ""
-    msg_ok "Login: ${GN}${admin_user}${CL} / ${GN}${admin_pass}${CL}"
+    msg_ok "Login: ${GN}${admin_user}${CL} (password in ~/copyparty.creds)"
   fi
 }
 

tools/addon/filebrowser-quantum.sh

@@ -189,6 +189,8 @@ chown root:root /usr/local/community-scripts
 chmod 755 /usr/local/community-scripts
 msg_ok "Directory prepared"
 
+ADMIN_PASS=$(random_password 20)
+msg_warn "FileBrowser runs as root and shows the whole filesystem. Without authentication, anyone who reaches port ${PORT} can read and change every file."
 echo -n "${TAB}Use No Authentication? (y/N): "
 read -r noauth_prompt
 
@@ -234,9 +236,12 @@ server:
           - neverWatchPath: "/lost+found"
 auth:
   adminUsername: admin
-  adminPassword: community-scripts.org
+  adminPassword: ${ADMIN_PASS}
 EOF
-  msg_ok "Configured with default admin (admin / community-scripts.org)"
+  chmod 600 "$CONFIG_PATH"
+  echo -e "FileBrowser Quantum\nUsername: admin\nPassword: ${ADMIN_PASS}" >~/filebrowser-quantum.creds
+  chmod 600 ~/filebrowser-quantum.creds
+  msg_ok "Configured admin (credentials saved in ~/filebrowser-quantum.creds)"
 fi
 
 msg_info "Creating service"
@@ -276,4 +281,13 @@ EOF
 fi
 
 msg_ok "Service created successfully"
+
+# auth.adminPassword resets the password on every start, so it stays only until the admin exists
+if grep -q '^\s*adminPassword:' "$CONFIG_PATH"; then
+  for _ in {1..30}; do
+    [[ "$(curl -s -o /dev/null -w '%{http_code}' "http://127.0.0.1:${PORT}/health")" == "200" ]] && break
+    sleep 1
+  done
+  sed -i '/^\s*adminPassword:/d' "$CONFIG_PATH"
+fi
 msg_ok "${APP} is reachable at: ${BL}http://${IP}:${PORT}${CL}"

tools/addon/filebrowser.sh

@@ -122,9 +122,11 @@ if [[ "${install_prompt,,}" =~ ^(y|yes)$ ]]; then
   chmod 755 /usr/local/community-scripts
   touch "$DB_PATH"
   chown root:root "$DB_PATH"
-  chmod 644 "$DB_PATH"
+  chmod 600 "$DB_PATH"
   msg_ok "Directory created successfully"
 
+  ADMIN_PASS=$(random_password 20)
+  msg_warn "FileBrowser runs as root and shows the whole filesystem. Without authentication, anyone who reaches port ${PORT} can read and change every file."
   read -r -p "Would you like to use No Authentication? (y/N): " auth_prompt
   if [[ "${auth_prompt,,}" =~ ^(y|yes)$ ]]; then
     msg_info "Configuring No Authentication"
@@ -133,16 +135,18 @@ if [[ "${install_prompt,,}" =~ ^(y|yes)$ ]]; then
     $STD filebrowser config set -a '0.0.0.0' -p "$PORT" -d "$DB_PATH"
     $STD filebrowser config set --auth.method=noauth --database "$DB_PATH"
     if ! filebrowser users update 1 --perm.admin --database "$DB_PATH" &>/dev/null; then
-      $STD filebrowser users add admin community-scripts.org --perm.admin --database "$DB_PATH"
+      $STD filebrowser users add admin "$ADMIN_PASS" --perm.admin --database "$DB_PATH"
     fi
     msg_ok "No Authentication configured"
   else
-    msg_info "Setting up default authentication"
+    msg_info "Setting up authentication"
     cd /usr/local/community-scripts
     $STD filebrowser config init -a '0.0.0.0' -p "$PORT" -d "$DB_PATH"
     $STD filebrowser config set -a '0.0.0.0' -p "$PORT" -d "$DB_PATH"
-    $STD filebrowser users add admin community-scripts.org --perm.admin --database "$DB_PATH"
+    $STD filebrowser users add admin "$ADMIN_PASS" --perm.admin --database "$DB_PATH"
-    msg_ok "Default authentication configured (admin:community-scripts.org)"
+    echo -e "FileBrowser\nUsername: admin\nPassword: ${ADMIN_PASS}" >~/filebrowser.creds
+    chmod 600 ~/filebrowser.creds
+    msg_ok "Authentication configured (credentials saved in ~/filebrowser.creds)"
   fi
 
   msg_info "Creating service"
@@ -156,7 +160,6 @@ After=network-online.target
 User=root
 WorkingDirectory=/usr/local/community-scripts
 ExecStartPre=/bin/touch /usr/local/community-scripts/filebrowser.db
-ExecStartPre=/usr/local/bin/filebrowser config set -a "0.0.0.0" -p ${PORT} -d /usr/local/community-scripts/filebrowser.db
 ExecStart=/usr/local/bin/filebrowser -r / -d /usr/local/community-scripts/filebrowser.db -p ${PORT}
 Restart=always
 

tools/addon/webmin.sh

@@ -30,6 +30,7 @@ catch_errors
 
 # Initialize all core functions (colors, formatting, icons, STD mode)
 load_functions
+confirm_not_pve_host
 require_debian_like
 
 header_info
@@ -49,9 +50,13 @@ msg_ok "Installed Prerequisites"
 
 msg_info "Installing ${APP}"
 fetch_and_deploy_gh_release "webmin" "webmin/webmin" "binary" "latest" "/opt/webmin" "webmin_*_all.deb"
-/usr/share/webmin/changepass.pl /etc/webmin root root &>/dev/null
+WEBMIN_PASS=$(random_password 20)
+/usr/share/webmin/changepass.pl /etc/webmin root "$WEBMIN_PASS" &>/dev/null
+echo -e "Webmin\nUsername: root\nPassword: ${WEBMIN_PASS}" >~/webmin.creds
+chmod 600 ~/webmin.creds
 msg_ok "Installed ${APP}"
 
 get_lxc_ip
 echo -e "Successfully Installed!! ${APP} should be reachable by going to ${BL}https://${LOCAL_IP}:10000${CL}"
+echo -e "Login: root, password in ~/webmin.creds"