docker-combined/entrypoint.sh

#!/bin/sh
set -e

# ── Generate ephemeral secrets for the in-container Redis stack ─────────────
# Nothing here is persisted or exposed outside this container; a fresh set is
# generated on every boot, matching World Monitor's own SELF_HOSTING.md model
# (openssl rand -hex 32) minus the manual .env step, since it's all internal.
export REDIS_PASSWORD="$(node -e "console.log(require('node:crypto').randomBytes(32).toString('hex'))")"
export REDIS_TOKEN="$(node -e "console.log(require('node:crypto').randomBytes(32).toString('hex'))")"
export SRH_TOKEN="$REDIS_TOKEN"
export SRH_CONNECTION_STRING="redis://:${REDIS_PASSWORD}@127.0.0.1:6379"
export UPSTASH_REDIS_REST_URL="http://127.0.0.1:8079"
export UPSTASH_REDIS_REST_TOKEN="$REDIS_TOKEN"

export LOCAL_API_PORT="${LOCAL_API_PORT:-46123}"
export LOCAL_API_MODE="docker"
export LOCAL_API_CLOUD_FALLBACK="false"
if [ -z "${LOCAL_API_TOKEN:-}" ]; then
  LOCAL_API_TOKEN="$(node -e "console.log(require('node:crypto').randomBytes(32).toString('base64url'))")"
  export LOCAL_API_TOKEN
fi

# Signs the anonymous session cookie minted by /api/wm-session (api/_session.js
# fails closed — 503s every panel — without this, min 32 chars).
if [ -z "${WM_SESSION_SECRET:-}" ]; then
  WM_SESSION_SECRET="$(node -e "console.log(require('node:crypto').randomBytes(32).toString('hex'))")"
  export WM_SESSION_SECRET
fi

# World Monitor's own internal nginx (unmodified template, :8080) needs these
# two vars substituted in, same as its stock docker/entrypoint.sh.
envsubst '$LOCAL_API_PORT $LOCAL_API_TOKEN' < /etc/nginx/wm-internal.conf.template > /tmp/nginx-internal.conf
cp /etc/nginx/wm-outer.conf.template /tmp/nginx-outer.conf

exec /usr/bin/supervisord -c /etc/supervisor/conf.d/combined.conf