Tosone 3cb76aae80 feat(bootstrap): generate the credential master key on first start ...

auth.credentialKey is optional, so a deployment must work without operator
input. Generate a random 32-byte key on first start and persist it in the
settings table, which keeps the credential service able to decrypt values
written by an earlier process.

- run the task right after the services are registered, before signing
- take a distributed lock around the check-then-create and re-read inside
  it, otherwise two replicas starting together would generate different
  keys and leave half the credentials unreadable
- when auth.credentialKey is set it is authoritative: only its length is
  validated and nothing is written to the settings table

Verification:
- go test -tags "netgo,timetzdata,exclude_graphdriver_btrfs,containers_image_openpgp" ./pkg/app/bootstrap/...

2026-10-27 21:07:31 +08:00

..

bootstrap

feat(bootstrap): generate the credential master key on first start

2026-10-27 21:07:31 +08:00

distribution

chore: initial commit

2026-08-01 20:32:49 +08:00

server

refactor(server)!: remove the embedded MCP server

2026-10-21 19:33:07 +08:00

worker

refactor(build): restructure build runtime and logging codebase

2026-08-25 19:12:54 +08:00

cache_prewarm.go

chore: initial commit

2026-08-01 20:32:49 +08:00

drain.go

chore: initial commit

2026-08-01 20:32:49 +08:00

helper.go

refactor(server)!: remove the embedded MCP server

2026-10-21 19:33:07 +08:00

readiness.go

chore: initial commit

2026-08-01 20:32:49 +08:00