fix(indeedhub): generate per-node encryption root

CHANGELOG.md

@@ -4,6 +4,8 @@
 
 ## v1.8.12-alpha (2026-09-11)
 
+- **Fresh IndeedHub installs no longer share a fleet-wide encryption root.** The API now generates a persistent per-node AES master secret and shares it with the media worker through the platform's protected secret environment. Existing nodes migrate the exact legacy value they are already using before any container can be recreated, preserving access to encrypted data; an unreadable or empty existing root fails safely instead of being silently replaced. The manifest path, retired fallback installer, and container repair script follow the same rule.
+
 - **The Companion download advertises and re-announces the APK it actually serves.** The Discover banner and its install prompt now share the no-cache APK metadata, visibly report Companion 0.5.32 build 52, and remember dismissal per Android build rather than forever, so an existing browser gets one useful update prompt when the APK changes. The ISO gate reads the expected version from the Android build itself instead of accepting the stale 0.5.28 payload.
 
 - **GitWorkshop's dependency audit is clean.** The pinned upstream client keeps its separately reviewable Archipelago integration patch and now applies a deterministic dependency patch: safe lock refreshes plus targeted `fflate`, React Router, and Vitest upgrades remove all ten production advisories and all eight development advisories. A clean install reports zero vulnerabilities; type-check, all 152 upstream unit tests, and the exact Archipelago subpath build pass.

apps/indeedhub-api/manifest.yml

@@ -19,14 +19,15 @@ app:
     pull_policy: if-not-present
     network: indeedhub-net
     network_aliases: [api]
-    # The JWT signing secret is owned here (no backend container owns it); the
-    # db + minio passwords are owned by indeedhub-postgres / indeedhub-minio and
-    # only consumed here. ensure_generated_secrets no-ops when a file already
-    # exists, so live values on .228 are preserved (postgres pw is fixed at
-    # PGDATA init — regenerating would lock the API out).
+    # The JWT signing secret and stable envelope-encryption root are owned here;
+    # the db + minio passwords are owned by indeedhub-postgres / indeedhub-minio
+    # and only consumed here. Existing nodes migrate the legacy AES value into
+    # the secret file once, while fresh nodes receive a unique per-node value.
     generated_secrets:
       - name: indeedhub-jwt
         kind: hex32
+      - name: indeedhub-aes-master
+        kind: hex16
     secret_env:
       - key: DATABASE_PASSWORD
         secret_file: indeedhub-db-password
@@ -34,6 +35,8 @@ app:
         secret_file: indeedhub-minio-password
       - key: NOSTR_JWT_SECRET
         secret_file: indeedhub-jwt
+      - key: AES_MASTER_SECRET
+        secret_file: indeedhub-aes-master
 
   dependencies:
     - app_id: indeedhub-postgres
@@ -67,9 +70,6 @@ app:
     - S3_PRIVATE_BUCKET_NAME=indeedhub-private
     - S3_PUBLIC_BUCKET_URL=/storage
     - NOSTR_JWT_EXPIRES_IN=7d
-    # Fixed across the fleet (envelope-encryption master key baked by the legacy
-    # installer); not node-specific, so a plain env literal, not a secret.
-    - AES_MASTER_SECRET=0123456789abcdef0123456789abcdef
     - ENVIRONMENT=production
 
   health_check:

apps/indeedhub-ffmpeg/manifest.yml

@@ -22,6 +22,8 @@ app:
         secret_file: indeedhub-db-password
       - key: AWS_SECRET_KEY
         secret_file: indeedhub-minio-password
+      - key: AES_MASTER_SECRET
+        secret_file: indeedhub-aes-master
 
   dependencies:
     - app_id: indeedhub-api
@@ -51,4 +53,3 @@ app:
     - S3_PUBLIC_BUCKET_NAME=indeedhub-public
     - S3_PRIVATE_BUCKET_NAME=indeedhub-private
     - ENVIRONMENT=production
-    - AES_MASTER_SECRET=0123456789abcdef0123456789abcdef

core/archipelago/src/api/rpc/package/stacks.rs

@@ -1559,6 +1559,31 @@ impl RpcHandler {
         self.set_install_progress("indeedhub", n_images, n_images)
             .await;
 
+        // The retired installer injected one fleet-wide AES root directly in
+        // the API/worker environment. Detect those consumers before removing
+        // anything, then persist the legacy value exactly once so an upgrade
+        // cannot orphan encrypted data. A genuinely fresh fallback install
+        // receives a random per-node root instead.
+        let mut had_existing_crypto_consumer = false;
+        for name in [
+            "indeedhub-api",
+            "indeedhub-ffmpeg",
+            "indeedhub-build_api_1",
+            "indeedhub-build_ffmpeg-worker_1",
+        ] {
+            let status =
+                podman_stack_status(&["container", "exists", name], PODMAN_STACK_PROBE_TIMEOUT)
+                    .await?;
+            had_existing_crypto_consumer |= status.success();
+        }
+        let secrets_dir = self.config.data_dir.join("secrets");
+        crate::container::secrets::ensure_indeedhub_aes_master_secret(
+            &secrets_dir,
+            had_existing_crypto_consumer,
+        )
+        .context("preparing IndeedHub encryption root")?;
+        let aes_master = crate::container::secrets::indeedhub_aes_master_secret(&secrets_dir)?;
+
         // Remove any leftover containers from a previous partial install (or
         // from the first-boot frontend stub that used to race the installer).
         // Without this, `podman run --name indeedhub` fails on name conflict
@@ -1759,7 +1784,7 @@ impl RpcHandler {
                 "-e".to_string(),
                 "NOSTR_JWT_EXPIRES_IN=7d".to_string(),
                 "-e".to_string(),
-                "AES_MASTER_SECRET=0123456789abcdef0123456789abcdef".to_string(),
+                format!("AES_MASTER_SECRET={aes_master}"),
                 "-e".to_string(),
                 "ENVIRONMENT=production".to_string(),
                 format!("{registry}/indeedhub-api:1.0.0"),
@@ -1810,7 +1835,7 @@ impl RpcHandler {
                 "-e".to_string(),
                 "ENVIRONMENT=production".to_string(),
                 "-e".to_string(),
-                "AES_MASTER_SECRET=0123456789abcdef0123456789abcdef".to_string(),
+                format!("AES_MASTER_SECRET={aes_master}"),
                 format!("{registry}/indeedhub-ffmpeg:1.0.0"),
             ],
             &tmp_env,

core/archipelago/src/container/prod_orchestrator.rs

@@ -3565,6 +3565,54 @@ impl ProdContainerOrchestrator {
         Ok(())
     }
 
+    /// Materialise IndeedHub's AES root before the generic generated-secret
+    /// pass. Old installers injected one known value directly into the API and
+    /// worker environments, so an upgrade with either consumer still present
+    /// must persist that value before container drift can recreate them. With
+    /// no existing consumer this is a fresh install and receives random bytes.
+    async fn ensure_indeedhub_aes_master(&self, manifest: &AppManifest) -> Result<()> {
+        if manifest.app.id != "indeedhub-api" {
+            return Ok(());
+        }
+
+        let secret_path = self
+            .secrets_dir
+            .join(crate::container::secrets::INDEEDHUB_AES_SECRET_NAME);
+        let preserve_legacy = if secret_path.exists() {
+            // The secret helper validates the existing file and, critically,
+            // refuses to replace a damaged encryption root.
+            false
+        } else {
+            let consumers = [
+                "indeedhub-api",
+                "indeedhub-ffmpeg",
+                "indeedhub-build_api_1",
+                "indeedhub-build_ffmpeg-worker_1",
+            ];
+            self.runtime
+                .list_containers()
+                .await
+                .context("detecting an existing IndeedHub encryption-key consumer")?
+                .iter()
+                .any(|container| {
+                    let name = container.name.trim_start_matches('/');
+                    consumers.contains(&name)
+                })
+        };
+
+        if crate::container::secrets::ensure_indeedhub_aes_master_secret(
+            &self.secrets_dir,
+            preserve_legacy,
+        )? {
+            tracing::info!(
+                app = "indeedhub-api",
+                path = %secret_path.display(),
+                "Persisted the legacy IndeedHub encryption root for upgrade compatibility"
+            );
+        }
+        Ok(())
+    }
+
     async fn resolve_dynamic_env(&self, manifest: &mut AppManifest) -> Result<()> {
         // Idempotency guard: partitioning already ran on this instance.
         // Re-running would re-taint against an environment that no longer
@@ -3573,6 +3621,11 @@ impl ProdContainerOrchestrator {
         if !manifest.app.container.secret_env_refs.is_empty() {
             return Ok(());
         }
+        // IndeedHub's data-encryption root needs an upgrade-aware first pass:
+        // generic generation alone would replace the fleet-wide legacy value
+        // and make previously encrypted data unreadable.
+        self.ensure_indeedhub_aes_master(manifest).await?;
+
         // Materialise any manifest-declared generated secrets before they're
         // read below. This is the single chokepoint every install/reconcile
         // path funnels through, so an app's secrets exist by the time its
@@ -5627,6 +5680,52 @@ app:
         "app:\n  id: fedimint-gateway\n  name: Fedimint Gateway\n  version: 0.10.0\n  container:\n    image: x:1\n    generated_secrets:\n      - name: fedimint-gateway-hash\n        kind: bcrypt\n    secret_env:\n      - key: FEDI_HASH\n        secret_file: fedimint-gateway-hash\n"
     }
 
+    fn indeedhub_api_manifest_yaml() -> &'static str {
+        "app:\n  id: indeedhub-api\n  name: IndeedHub API\n  version: 1.0.0\n  container:\n    image: x:1\n    generated_secrets:\n      - name: indeedhub-aes-master\n        kind: hex16\n    secret_env:\n      - key: AES_MASTER_SECRET\n        secret_file: indeedhub-aes-master\n"
+    }
+
+    #[tokio::test]
+    async fn existing_indeedhub_consumer_gets_migration_compatible_root() {
+        let rt = Arc::new(MockRuntime::default());
+        rt.set_state("indeedhub-api", ContainerState::Running);
+        let mut orch = orch_with(rt).await;
+        let tmp = tempfile::TempDir::new().unwrap();
+        orch.set_secrets_dir(tmp.path().to_path_buf());
+
+        let mut manifest = AppManifest::parse(indeedhub_api_manifest_yaml()).unwrap();
+        orch.resolve_dynamic_env(&mut manifest).await.unwrap();
+        let resolved = manifest
+            .app
+            .container
+            .secret_env_refs
+            .iter()
+            .find(|entry| entry.env_key == "AES_MASTER_SECRET")
+            .unwrap();
+        assert_eq!(resolved.value.len(), 32);
+        assert!(tmp.path().join("indeedhub-aes-master").exists());
+        assert!(
+            crate::container::secrets::ensure_indeedhub_aes_master_secret(tmp.path(), true).is_ok(),
+            "the migrated file remains valid and stable"
+        );
+    }
+
+    #[tokio::test]
+    async fn fresh_indeedhub_install_gets_random_root() {
+        let rt = Arc::new(MockRuntime::default());
+        let mut orch = orch_with(rt).await;
+        let tmp = tempfile::TempDir::new().unwrap();
+        orch.set_secrets_dir(tmp.path().to_path_buf());
+
+        let mut manifest = AppManifest::parse(indeedhub_api_manifest_yaml()).unwrap();
+        orch.resolve_dynamic_env(&mut manifest).await.unwrap();
+        let first = crate::container::secrets::indeedhub_aes_master_secret(tmp.path()).unwrap();
+
+        let other = tempfile::TempDir::new().unwrap();
+        crate::container::secrets::ensure_indeedhub_aes_master_secret(other.path(), false).unwrap();
+        let second = crate::container::secrets::indeedhub_aes_master_secret(other.path()).unwrap();
+        assert_ne!(first, second, "fresh installs must receive per-node roots");
+    }
+
     /// FED-07. Rotating a compromised credential leaves the RUNNING container
     /// holding the old value, so the rotation must flag the app for recreate.
     /// Without the flag the drift check skips it as restart-sensitive and the

core/archipelago/src/container/secrets.rs

@@ -140,6 +140,79 @@ fn random_base64(bytes: usize) -> String {
 /// daemon read `fedimint-gateway-hash`).
 pub const GATEWAY_HASH_SECRET_NAME: &str = "fedimint-gateway-hash";
 
+/// Canonical filename for IndeedHub's envelope-encryption root. API and media
+/// worker must receive the same stable value: changing it after data has been
+/// encrypted can make that data unreadable.
+pub const INDEEDHUB_AES_SECRET_NAME: &str = "indeedhub-aes-master";
+
+/// The fleet-wide value used by the legacy IndeedHub installers. It remains
+/// here only for the one-way migration of an already-installed stack: those
+/// nodes must persist the value they have been using before the manifest
+/// starts reading it from a file. Fresh installs must never receive it.
+const KNOWN_LEGACY_INDEEDHUB_AES_MASTER: &str = "0123456789abcdef0123456789abcdef";
+
+/// Ensure IndeedHub has a stable encryption root.
+///
+/// `preserve_legacy` is true only when an API/worker container already exists,
+/// proving this is an upgrade from the installer that shipped the known legacy
+/// value. In that case we persist that value once so recreating the containers
+/// does not orphan encrypted data. A fresh installation gets 16 random bytes
+/// encoded as 32 hex characters.
+///
+/// Unlike ordinary generated credentials, an existing-but-empty or unreadable
+/// encryption root is never self-healed by rotation: replacement could destroy
+/// access to data, so this fails loudly and leaves the file untouched.
+/// Returns true only when the legacy migration value was written.
+pub fn ensure_indeedhub_aes_master_secret(
+    secrets_dir: &Path,
+    preserve_legacy: bool,
+) -> Result<bool> {
+    fs::create_dir_all(secrets_dir)
+        .with_context(|| format!("creating secrets dir {}", secrets_dir.display()))?;
+    let path = secrets_dir.join(INDEEDHUB_AES_SECRET_NAME);
+
+    if path.exists() {
+        let value = fs::read_to_string(&path).with_context(|| {
+            format!(
+                "reading IndeedHub encryption root {} (refusing to replace it)",
+                path.display()
+            )
+        })?;
+        if value.trim().is_empty() {
+            anyhow::bail!(
+                "IndeedHub encryption root {} is empty; refusing to replace a potentially \
+                 data-bearing key",
+                path.display()
+            );
+        }
+        return Ok(false);
+    }
+
+    if preserve_legacy {
+        write_secret(&path, KNOWN_LEGACY_INDEEDHUB_AES_MASTER)?;
+        return Ok(true);
+    }
+
+    let spec = GeneratedSecret {
+        name: INDEEDHUB_AES_SECRET_NAME.to_string(),
+        kind: SecretGenKind::Hex16,
+    };
+    ensure_one(secrets_dir, &spec)?;
+    Ok(false)
+}
+
+/// Read the stable IndeedHub encryption root after it has been materialised.
+pub fn indeedhub_aes_master_secret(secrets_dir: &Path) -> Result<String> {
+    let path = secrets_dir.join(INDEEDHUB_AES_SECRET_NAME);
+    let value = fs::read_to_string(&path)
+        .with_context(|| format!("reading IndeedHub encryption root {}", path.display()))?;
+    let value = value.trim();
+    if value.is_empty() {
+        anyhow::bail!("IndeedHub encryption root {} is empty", path.display());
+    }
+    Ok(value.to_string())
+}
+
 /// Detection-only denylist of bcrypt hashes that shipped as hardcoded
 /// fallback credentials in this repository before FED-07. `t9YjjxkiktrlYvjajB
 /// /zgOMDnSNVg4HqrbDqh47u7Jf42whNdxNqC` was substituted for the Fedimint
@@ -356,6 +429,63 @@ mod tests {
         );
     }
 
+    #[test]
+    fn indeedhub_fresh_installs_get_distinct_per_node_encryption_roots() {
+        let dir_a = tempfile::tempdir().unwrap();
+        let dir_b = tempfile::tempdir().unwrap();
+
+        assert!(!ensure_indeedhub_aes_master_secret(dir_a.path(), false).unwrap());
+        assert!(!ensure_indeedhub_aes_master_secret(dir_b.path(), false).unwrap());
+        let value_a = indeedhub_aes_master_secret(dir_a.path()).unwrap();
+        let value_b = indeedhub_aes_master_secret(dir_b.path()).unwrap();
+
+        assert_eq!(value_a.len(), 32);
+        assert!(value_a.chars().all(|c| c.is_ascii_hexdigit()));
+        assert_ne!(value_a, KNOWN_LEGACY_INDEEDHUB_AES_MASTER);
+        assert_ne!(value_a, value_b, "fresh nodes must not share an AES root");
+        let mode = std::fs::metadata(dir_a.path().join(INDEEDHUB_AES_SECRET_NAME))
+            .unwrap()
+            .permissions()
+            .mode()
+            & 0o777;
+        assert_eq!(mode, 0o600);
+    }
+
+    #[test]
+    fn indeedhub_existing_install_persists_legacy_root_once() {
+        let dir = tempfile::tempdir().unwrap();
+        assert!(ensure_indeedhub_aes_master_secret(dir.path(), true).unwrap());
+        assert_eq!(
+            indeedhub_aes_master_secret(dir.path()).unwrap(),
+            KNOWN_LEGACY_INDEEDHUB_AES_MASTER
+        );
+        assert!(
+            !ensure_indeedhub_aes_master_secret(dir.path(), true).unwrap(),
+            "a second migration pass must be a no-op"
+        );
+    }
+
+    #[test]
+    fn indeedhub_existing_unique_root_is_never_rotated() {
+        let dir = tempfile::tempdir().unwrap();
+        ensure_indeedhub_aes_master_secret(dir.path(), false).unwrap();
+        let before = indeedhub_aes_master_secret(dir.path()).unwrap();
+
+        assert!(!ensure_indeedhub_aes_master_secret(dir.path(), true).unwrap());
+        assert_eq!(before, indeedhub_aes_master_secret(dir.path()).unwrap());
+    }
+
+    #[test]
+    fn indeedhub_empty_root_fails_without_overwriting() {
+        let dir = tempfile::tempdir().unwrap();
+        let path = dir.path().join(INDEEDHUB_AES_SECRET_NAME);
+        std::fs::write(&path, "").unwrap();
+
+        let err = ensure_indeedhub_aes_master_secret(dir.path(), true).unwrap_err();
+        assert!(err.to_string().contains("refusing to replace"));
+        assert_eq!(std::fs::read(&path).unwrap(), b"");
+    }
+
     #[test]
     fn gateway_credential_fresh_generation_verifies_and_is_0600() {
         let dir = tempfile::tempdir().unwrap();

scripts/fix-indeedhub-containers.sh

@@ -21,6 +21,63 @@ echo "Node IP: $NODE_IP"
 
 NETWORK="indeedhub-build_indeedhub-network"
 
+# Preserve every credential before any existing stack member is removed. Old
+# installs carried some only in container environments; fresh repairs get
+# random per-node values. Never print a value into repair logs.
+SECRETS_DIR="/var/lib/archipelago/secrets"
+ensure_secret_from_container_env() {
+  secret_name="$1"
+  random_bytes="$2"
+  shift 2
+  secret_path="$SECRETS_DIR/$secret_name"
+  if [ -e "$secret_path" ] && { [ ! -r "$secret_path" ] || [ ! -s "$secret_path" ]; }; then
+    echo "ERROR: $secret_name exists but is unreadable or empty; refusing to replace it."
+    exit 1
+  fi
+  if [ ! -e "$secret_path" ]; then
+    recovered=""
+    for source in "$@"; do
+      c="${source%%:*}"
+      env_key="${source#*:}"
+      if podman container exists "$c" 2>/dev/null; then
+        candidate=$(podman inspect "$c" --format '{{range .Config.Env}}{{println .}}{{end}}' 2>/dev/null | sed -n "s/^${env_key}=//p" | head -1)
+        if [ -n "$candidate" ]; then
+          recovered="$candidate"
+          break
+        fi
+      fi
+    done
+    if [ -z "$recovered" ]; then
+      recovered=$(openssl rand -hex "$random_bytes")
+    fi
+    mkdir -p "$SECRETS_DIR"
+    umask 077
+    secret_tmp=$(mktemp "$SECRETS_DIR/.${secret_name}.XXXXXX")
+    printf '%s' "$recovered" > "$secret_tmp"
+    chmod 600 "$secret_tmp"
+    mv "$secret_tmp" "$secret_path"
+  fi
+}
+
+ensure_secret_from_container_env indeedhub-aes-master 16 \
+  indeedhub-api:AES_MASTER_SECRET indeedhub-ffmpeg:AES_MASTER_SECRET \
+  indeedhub-build_api_1:AES_MASTER_SECRET indeedhub-build_ffmpeg-worker_1:AES_MASTER_SECRET
+ensure_secret_from_container_env indeedhub-db-password 24 \
+  indeedhub-api:DATABASE_PASSWORD indeedhub-ffmpeg:DATABASE_PASSWORD \
+  indeedhub-build_api_1:DATABASE_PASSWORD indeedhub-build_ffmpeg-worker_1:DATABASE_PASSWORD \
+  indeedhub-postgres:POSTGRES_PASSWORD
+ensure_secret_from_container_env indeedhub-minio-password 24 \
+  indeedhub-api:AWS_SECRET_KEY indeedhub-ffmpeg:AWS_SECRET_KEY \
+  indeedhub-build_api_1:AWS_SECRET_KEY indeedhub-build_ffmpeg-worker_1:AWS_SECRET_KEY \
+  indeedhub-minio:MINIO_ROOT_PASSWORD
+ensure_secret_from_container_env indeedhub-jwt 32 \
+  indeedhub-api:NOSTR_JWT_SECRET indeedhub-build_api_1:NOSTR_JWT_SECRET
+
+AES_MASTER_SECRET=$(tr -d '\r\n' < "$SECRETS_DIR/indeedhub-aes-master")
+DATABASE_PASSWORD=$(tr -d '\r\n' < "$SECRETS_DIR/indeedhub-db-password")
+MINIO_ROOT_PASSWORD=$(tr -d '\r\n' < "$SECRETS_DIR/indeedhub-minio-password")
+NOSTR_JWT_SECRET=$(tr -d '\r\n' < "$SECRETS_DIR/indeedhub-jwt")
+
 # Load custom images if tar exists
 if [ -f /tmp/indeedhub-images.tar ]; then
   echo "Loading custom images from tar..."
@@ -62,7 +119,7 @@ podman run -d --name indeedhub-postgres \
   --network "$NETWORK" --network-alias postgres \
   -v indeedhub-postgres-data:/var/lib/postgresql/data \
   -e POSTGRES_USER=indeedhub \
-  -e POSTGRES_PASSWORD=indeehhub-archy-2026 \
+  -e POSTGRES_PASSWORD="$DATABASE_PASSWORD" \
   -e POSTGRES_DB=indeedhub \
   "$INDEEDHUB_POSTGRES_IMAGE"
 
@@ -92,7 +149,7 @@ podman run -d --name indeedhub-minio \
   --network "$NETWORK" --network-alias minio \
   -v indeedhub-minio-data:/data \
   -e MINIO_ROOT_USER=indeeadmin \
-  -e MINIO_ROOT_PASSWORD=indeeadmin2026 \
+  -e MINIO_ROOT_PASSWORD="$MINIO_ROOT_PASSWORD" \
   "${MINIO_IMAGE}" \
   server /data --console-address ":9001"
 
@@ -116,7 +173,7 @@ podman run -d --name indeedhub-build_api_1 \
   -e DATABASE_HOST=postgres \
   -e DATABASE_PORT=5432 \
   -e DATABASE_USER=indeedhub \
-  -e DATABASE_PASSWORD=indeehhub-archy-2026 \
+  -e DATABASE_PASSWORD="$DATABASE_PASSWORD" \
   -e DATABASE_NAME=indeedhub \
   -e QUEUE_HOST=redis \
   -e QUEUE_PORT=6379 \
@@ -124,7 +181,7 @@ podman run -d --name indeedhub-build_api_1 \
   -e S3_ENDPOINT=http://minio:9000 \
   -e AWS_REGION=us-east-1 \
   -e AWS_ACCESS_KEY=indeeadmin \
-  -e AWS_SECRET_KEY=indeeadmin2026 \
+  -e AWS_SECRET_KEY="$MINIO_ROOT_PASSWORD" \
   -e S3_PRIVATE_BUCKET_NAME=indeedhub-private \
   -e S3_PUBLIC_BUCKET_NAME=indeedhub-public \
   -e S3_PUBLIC_BUCKET_URL=/storage \
@@ -132,9 +189,9 @@ podman run -d --name indeedhub-build_api_1 \
   -e "BTCPAY_API_KEY=" \
   -e "BTCPAY_STORE_ID=" \
   -e "BTCPAY_WEBHOOK_SECRET=" \
-  -e NOSTR_JWT_SECRET=archipelago-indeehhub-jwt-secret-2026 \
+  -e NOSTR_JWT_SECRET="$NOSTR_JWT_SECRET" \
   -e NOSTR_JWT_EXPIRES_IN=7d \
-  -e AES_MASTER_SECRET=0123456789abcdef0123456789abcdef \
+  -e AES_MASTER_SECRET="$AES_MASTER_SECRET" \
   -e "ADMIN_API_KEY=" \
   -e NODE_OPTIONS=--max-old-space-size=1024 \
   --health-cmd "wget --no-verbose --tries=1 --spider http://localhost:4000/nostr-auth/health || exit 1" \
@@ -154,7 +211,7 @@ podman run -d --name indeedhub-build_ffmpeg-worker_1 \
   -e DATABASE_HOST=postgres \
   -e DATABASE_PORT=5432 \
   -e DATABASE_USER=indeedhub \
-  -e DATABASE_PASSWORD=indeehhub-archy-2026 \
+  -e DATABASE_PASSWORD="$DATABASE_PASSWORD" \
   -e DATABASE_NAME=indeedhub \
   -e QUEUE_HOST=redis \
   -e QUEUE_PORT=6379 \
@@ -162,11 +219,11 @@ podman run -d --name indeedhub-build_ffmpeg-worker_1 \
   -e S3_ENDPOINT=http://minio:9000 \
   -e AWS_REGION=us-east-1 \
   -e AWS_ACCESS_KEY=indeeadmin \
-  -e AWS_SECRET_KEY=indeeadmin2026 \
+  -e AWS_SECRET_KEY="$MINIO_ROOT_PASSWORD" \
   -e S3_PRIVATE_BUCKET_NAME=indeedhub-private \
   -e S3_PUBLIC_BUCKET_NAME=indeedhub-public \
   -e S3_PUBLIC_BUCKET_URL=/storage \
-  -e AES_MASTER_SECRET=0123456789abcdef0123456789abcdef \
+  -e AES_MASTER_SECRET="$AES_MASTER_SECRET" \
   localhost/indeedhub-build_ffmpeg-worker:local
 
 # 7. IndeedHub Frontend