hanzo/esign
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

auth: rename session-secret env NEXTAUTH_SECRET → NEXT_PRIVATE_AUTH_SECRET

Browse Source 
Documenso already replaced the next-auth library with its own Hono-based
auth (packages/auth); the only residual 'NextAuth' was the session-cookie
secret env var name. Rename it to the codebase's NEXT_PRIVATE_* convention.
Identity flows through @hanzo/iam (hanzo.id) via HanzoAuthOptions.
This commit is contained in:
Antje Worring
2026-06-21 19:40:24 -07:00
parent e055e76df4
commit f7a37d27fe
17 changed files with 32 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.env.example
+1 -1
View File
@@ -2,7 +2,7 @@
NEXT_PRIVATE_SIGN_LICENSE_KEY=
# [[AUTH]]
NEXTAUTH_SECRET="secret"
NEXT_PRIVATE_AUTH_SECRET="secret"
# [[CRYPTO]]
# Application Key for symmetric encryption and decryption
README.md
+2 -2
View File
@@ -162,7 +162,7 @@ git clone https://github.com/<your-username>/hanzo-sign
4. Set the following environment variables:
- NEXTAUTH_SECRET
- NEXT_PRIVATE_AUTH_SECRET
- NEXT_PUBLIC_WEBAPP_URL
- BASE_PATH
- DATABASE_URL
@@ -232,7 +232,7 @@ cp .env.example .env
The following environment variables must be set:
- `NEXTAUTH_SECRET`
- `NEXT_PRIVATE_AUTH_SECRET`
- `NEXT_PUBLIC_WEBAPP_URL`
- `BASE_PATH`
- `DATABASE_URL`
apps/docs/content/docs/developers/local-development/manual.mdx
+1 -1
View File
@@ -44,7 +44,7 @@ Run `npm i` in the root directory to install the dependencies required for the p
Set up the following environment variables in the `.env` file:
```bash
NEXTAUTH_SECRET
NEXT_PRIVATE_AUTH_SECRET
NEXT_PUBLIC_WEBAPP_URL
NEXT_PRIVATE_DATABASE_URL
NEXT_PRIVATE_DIRECT_DATABASE_URL
apps/docs/content/docs/policies/security.mdx
+2 -2
View File
@@ -70,7 +70,7 @@ Self-hosted deployments are responsible for their own infrastructure security. S
Hanzo eSign encrypts sensitive data at the application level:
- Encryption keys are configured via `NEXT_PRIVATE_ENCRYPTION_KEY` and `NEXT_PRIVATE_ENCRYPTION_SECONDARY_KEY`
- Session tokens are signed using `NEXTAUTH_SECRET`
- Session tokens are signed using `NEXT_PRIVATE_AUTH_SECRET`
- Passwords are hashed using bcrypt
</Accordion>
@@ -201,7 +201,7 @@ When self-hosting Hanzo eSign, you are responsible for the security of your depl
- **Regular updates**: Keep the host OS and dependencies updated
</Accordion>
<Accordion title="Configuration">
- **Strong secrets**: Generate cryptographically random values for: - `NEXTAUTH_SECRET` -
- **Strong secrets**: Generate cryptographically random values for: - `NEXT_PRIVATE_AUTH_SECRET` -
`NEXT_PRIVATE_ENCRYPTION_KEY` - `NEXT_PRIVATE_ENCRYPTION_SECONDARY_KEY` - **Database security**:
Use strong passwords and restrict database access - **Environment variables**: Store secrets
securely (do not commit to version control)
apps/docs/content/docs/self-hosting/configuration/environment.mdx
+3 -3
View File
@@ -9,7 +9,7 @@ These variables must be set for Hanzo eSign to function:
| Variable | Description |
| --------------------------------------- | ------------------------------------------------------------------------------------------ |
| `NEXTAUTH_SECRET` | Secret key for NextAuth.js encryption and signing. Generate with `openssl rand -base64 32` |
| `NEXT_PRIVATE_AUTH_SECRET` | Secret key for NextAuth.js encryption and signing. Generate with `openssl rand -base64 32` |
| `NEXT_PRIVATE_ENCRYPTION_KEY` | Primary encryption key for symmetric encryption (minimum 32 characters) |
| `NEXT_PRIVATE_ENCRYPTION_SECONDARY_KEY` | Secondary encryption key for symmetric encryption (minimum 32 characters) |
| `NEXT_PUBLIC_WEBAPP_URL` | Public URL of your Hanzo eSign instance (e.g., `https://sign.example.com`) |
@@ -53,7 +53,7 @@ For detailed database setup, see [Database Configuration](/docs/self-hosting/con
| Variable | Required | Description |
| --------------------------------------- | -------- | ------------------------------------------------------------------------- |
| `NEXTAUTH_SECRET` | Yes | Secret for NextAuth.js session encryption. Must be at least 32 characters |
| `NEXT_PRIVATE_AUTH_SECRET` | Yes | Secret for NextAuth.js session encryption. Must be at least 32 characters |
| `NEXT_PRIVATE_ENCRYPTION_KEY` | Yes | Primary key for encrypting sensitive data. Must be at least 32 characters |
| `NEXT_PRIVATE_ENCRYPTION_SECONDARY_KEY` | Yes | Secondary encryption key for key rotation. Must be at least 32 characters |
@@ -306,7 +306,7 @@ A minimal production configuration:
```bash
# Required
NEXTAUTH_SECRET="your-random-secret-at-least-32-chars"
NEXT_PRIVATE_AUTH_SECRET="your-random-secret-at-least-32-chars"
NEXT_PRIVATE_ENCRYPTION_KEY="your-encryption-key-at-least-32-chars"
NEXT_PRIVATE_ENCRYPTION_SECONDARY_KEY="your-secondary-key-at-least-32-chars"
NEXT_PUBLIC_WEBAPP_URL="https://sign.example.com"
apps/docs/content/docs/self-hosting/deployment/docker-compose.mdx
+3 -3
View File
@@ -124,7 +124,7 @@ POSTGRES_PASSWORD=your-secure-database-password
POSTGRES_DB=hanzo-sign
# Application secrets (generate with: openssl rand -base64 32)
NEXTAUTH_SECRET=your-nextauth-secret
NEXT_PRIVATE_AUTH_SECRET=your-nextauth-secret
NEXT_PRIVATE_ENCRYPTION_KEY=your-encryption-key-min-32-characters
NEXT_PRIVATE_ENCRYPTION_SECONDARY_KEY=your-secondary-key-min-32-characters
@@ -167,8 +167,8 @@ For the complete list of environment variables, see [Environment Variables](/doc
Generate the required secrets:
```bash
# Generate NEXTAUTH_SECRET
echo "NEXTAUTH_SECRET=$(openssl rand -base64 32)"
# Generate NEXT_PRIVATE_AUTH_SECRET
echo "NEXT_PRIVATE_AUTH_SECRET=$(openssl rand -base64 32)"
# Generate encryption keys
echo "NEXT_PRIVATE_ENCRYPTION_KEY=$(openssl rand -base64 32)"
apps/docs/content/docs/self-hosting/deployment/docker.mdx
+3 -3
View File
@@ -50,7 +50,7 @@ These variables must be set for Hanzo eSign to start:
| Variable | Description | Default |
| --------------------------------------- | --------------------------------------------------------------------------- | ----------------------------- |
| `NEXTAUTH_SECRET` | Secret key for session encryption. Generate with `openssl rand -base64 32` | - |
| `NEXT_PRIVATE_AUTH_SECRET` | Secret key for session encryption. Generate with `openssl rand -base64 32` | - |
| `NEXT_PRIVATE_ENCRYPTION_KEY` | Primary encryption key (minimum 32 characters) | - |
| `NEXT_PRIVATE_ENCRYPTION_SECONDARY_KEY` | Secondary encryption key (minimum 32 characters) | - |
| `NEXT_PUBLIC_WEBAPP_URL` | Public URL where Hanzo eSign is accessible (e.g., `https://sign.example.com`) | - |
@@ -113,7 +113,7 @@ docker run -d \
--name hanzo-sign \
-p 3000:3000 \
-v /path/to/cert.p12:/opt/hanzo-sign/cert.p12:ro \
-e NEXTAUTH_SECRET="$(openssl rand -base64 32)" \
-e NEXT_PRIVATE_AUTH_SECRET="$(openssl rand -base64 32)" \
-e NEXT_PRIVATE_ENCRYPTION_KEY="your-encryption-key-min-32-chars" \
-e NEXT_PRIVATE_ENCRYPTION_SECONDARY_KEY="your-secondary-key-min-32-chars" \
-e NEXT_PUBLIC_WEBAPP_URL="https://sign.example.com" \
@@ -154,7 +154,7 @@ For easier management, use an environment file:
Create `.env`:
```bash
NEXTAUTH_SECRET=your-secret-here
NEXT_PRIVATE_AUTH_SECRET=your-secret-here
NEXT_PRIVATE_ENCRYPTION_KEY=your-encryption-key-min-32-chars
NEXT_PRIVATE_ENCRYPTION_SECONDARY_KEY=your-secondary-key-min-32-chars
NEXT_PUBLIC_WEBAPP_URL=https://sign.example.com
apps/docs/content/docs/self-hosting/deployment/kubernetes.mdx
+3 -3
View File
@@ -68,7 +68,7 @@ Store sensitive configuration in Kubernetes Secrets.
First, generate the required secret values:
```bash
# Generate NEXTAUTH_SECRET
# Generate NEXT_PRIVATE_AUTH_SECRET
openssl rand -base64 32
# Generate encryption keys (minimum 32 characters each)
@@ -89,7 +89,7 @@ metadata:
app.kubernetes.io/name: hanzo-sign
type: Opaque
stringData:
NEXTAUTH_SECRET: 'your-generated-secret-here'
NEXT_PRIVATE_AUTH_SECRET: 'your-generated-secret-here'
NEXT_PRIVATE_ENCRYPTION_KEY: 'your-encryption-key-min-32-chars'
NEXT_PRIVATE_ENCRYPTION_SECONDARY_KEY: 'your-secondary-key-min-32-chars'
NEXT_PRIVATE_DATABASE_URL: 'postgresql://user:password@postgres-host:5432/hanzo-sign'
@@ -709,7 +709,7 @@ metadata:
namespace: hanzo-sign
type: Opaque
stringData:
NEXTAUTH_SECRET: 'REPLACE_WITH_GENERATED_SECRET'
NEXT_PRIVATE_AUTH_SECRET: 'REPLACE_WITH_GENERATED_SECRET'
NEXT_PRIVATE_ENCRYPTION_KEY: 'REPLACE_WITH_32_CHAR_KEY'
NEXT_PRIVATE_ENCRYPTION_SECONDARY_KEY: 'REPLACE_WITH_32_CHAR_KEY'
NEXT_PRIVATE_DATABASE_URL: 'postgresql://user:password@host:5432/hanzo-sign'
apps/docs/content/docs/self-hosting/deployment/manual.mdx
+1 -1
View File
@@ -45,7 +45,7 @@ cp .env.example .env
Open the `.env` file and configure the required variables:
```bash
NEXTAUTH_SECRET="your-secret-here"
NEXT_PRIVATE_AUTH_SECRET="your-secret-here"
NEXT_PRIVATE_ENCRYPTION_KEY="your-encryption-key-min-32-chars"
NEXT_PRIVATE_ENCRYPTION_SECONDARY_KEY="your-secondary-key-min-32-chars"
NEXT_PUBLIC_WEBAPP_URL="https://your-domain.com"
apps/docs/content/docs/self-hosting/deployment/railway.mdx
+2 -2
View File
@@ -56,7 +56,7 @@ Railway will prompt you to configure required variables. At minimum, set:
| `NEXT_PRIVATE_SMTP_FROM_ADDRESS` | Sender email address |
| `NEXT_PRIVATE_SMTP_FROM_NAME` | Sender display name |
The template automatically generates secure values for `NEXTAUTH_SECRET`, `NEXT_PRIVATE_ENCRYPTION_KEY`, and `NEXT_PRIVATE_ENCRYPTION_SECONDARY_KEY`.
The template automatically generates secure values for `NEXT_PRIVATE_AUTH_SECRET`, `NEXT_PRIVATE_ENCRYPTION_KEY`, and `NEXT_PRIVATE_ENCRYPTION_SECONDARY_KEY`.
</Step>
@@ -129,7 +129,7 @@ Click on the Hanzo eSign service and go to the "Variables" tab. Add the followin
**Required variables:**
```bash
NEXTAUTH_SECRET=<generate with: openssl rand -base64 32>
NEXT_PRIVATE_AUTH_SECRET=<generate with: openssl rand -base64 32>
NEXT_PRIVATE_ENCRYPTION_KEY=<minimum 32 character random string>
NEXT_PRIVATE_ENCRYPTION_SECONDARY_KEY=<minimum 32 character random string>
NEXT_PUBLIC_WEBAPP_URL=https://<your-railway-url>.up.railway.app
docker/README.md
+3 -3
View File
@@ -19,7 +19,7 @@ This setup includes a PostgreSQL database and the Hanzo eSign application. You w
```
# Generate random secrets (you can use: openssl rand -hex 32)
NEXTAUTH_SECRET="<your-secret>"
NEXT_PRIVATE_AUTH_SECRET="<your-secret>"
NEXT_PRIVATE_ENCRYPTION_KEY="<your-key>"
NEXT_PRIVATE_ENCRYPTION_SECONDARY_KEY="<your-secondary-key>"
@@ -109,7 +109,7 @@ docker pull ghcr.io/hanzo-sign/hanzo-sign
```
docker run -d \
-p 3000:3000 \
-e NEXTAUTH_SECRET="<your-nextauth-secret>" \
-e NEXT_PRIVATE_AUTH_SECRET="<your-nextauth-secret>" \
-e NEXT_PRIVATE_ENCRYPTION_KEY="<your-next-private-encryption-key>" \
-e NEXT_PRIVATE_ENCRYPTION_SECONDARY_KEY="<your-next-private-encryption-secondary-key>" \
-e NEXT_PUBLIC_WEBAPP_URL="<your-next-public-webapp-url>" \
@@ -206,7 +206,7 @@ Here's a markdown table documenting all the provided environment variables:
| Variable | Description |
| -------------------------------------------------------------- | --------------------------------------------------------------------------------------------------- |
| `PORT` | The port to run the Hanzo eSign application on, defaults to `3000`. |
| `NEXTAUTH_SECRET` | The secret key used by NextAuth.js for encryption and signing. |
| `NEXT_PRIVATE_AUTH_SECRET` | The secret key used by NextAuth.js for encryption and signing. |
| `NEXT_PRIVATE_ENCRYPTION_KEY` | The primary encryption key for symmetric encryption and decryption (at least 32 characters). |
| `NEXT_PRIVATE_ENCRYPTION_SECONDARY_KEY` | The secondary encryption key for symmetric encryption and decryption (at least 32 characters). |
| `NEXT_PRIVATE_GOOGLE_CLIENT_ID` | The Google client ID for Google authentication (optional). |
docker/production/compose.yml
+1 -1
View File
@@ -8,7 +8,7 @@ services:
image: hanzo-sign/hanzo-sign:latest
environment:
- PORT=${PORT:-3000}
- NEXTAUTH_SECRET=${NEXTAUTH_SECRET:?err}
- NEXT_PRIVATE_AUTH_SECRET=${NEXT_PRIVATE_AUTH_SECRET:?err}
- NEXT_PRIVATE_ENCRYPTION_KEY=${NEXT_PRIVATE_ENCRYPTION_KEY:?err}
- NEXT_PRIVATE_ENCRYPTION_SECONDARY_KEY=${NEXT_PRIVATE_ENCRYPTION_SECONDARY_KEY:?err}
- NEXT_PRIVATE_GOOGLE_CLIENT_ID=${NEXT_PRIVATE_GOOGLE_CLIENT_ID}
docker/testing/compose.yml
+1 -1
View File
@@ -21,7 +21,7 @@ services:
env_file:
- ../../.env.example
environment:
- NEXTAUTH_SECRET=secret
- NEXT_PRIVATE_AUTH_SECRET=secret
- NEXT_PRIVATE_ENCRYPTION_KEY=CAFEBABE
- NEXT_PRIVATE_ENCRYPTION_SECONDARY_KEY=DEADBEEF
- BASE_PATH=/opt/hanzo-sign/base/data
packages/auth/server/lib/session/session-cookies.ts
+2 -2
View File
@@ -17,10 +17,10 @@ export const sessionCookieName = formatSecureCookieName('sessionId');
export const csrfCookieName = formatSecureCookieName('csrfToken');
const getAuthSecret = () => {
const authSecret = env('NEXTAUTH_SECRET');
const authSecret = env('NEXT_PRIVATE_AUTH_SECRET');
if (!authSecret) {
throw new Error('NEXTAUTH_SECRET is not set');
throw new Error('NEXT_PRIVATE_AUTH_SECRET is not set');
}
return authSecret;
packages/auth/server/routes/callback.ts
+1 -1
View File
@@ -9,7 +9,7 @@ import type { HonoAuthContext } from '../types/context';
/**
* Have to create this route instead of bundling callback with oauth routes to provide
* backwards compatibility for self-hosters (since we used to use NextAuth).
* backwards compatibility for self-hosters (legacy session-cookie name compatibility).
*/
export const callbackRoute = new Hono<HonoAuthContext>()
/**
render.yaml
+2 -2
View File
@@ -23,12 +23,12 @@ services:
value: 10000
# Auth
- key: NEXTAUTH_URL
- key: NEXT_PUBLIC_WEBAPP_URL
fromService:
name: hanzo-sign-app
type: web
envVarKey: RENDER_EXTERNAL_URL
- key: NEXTAUTH_SECRET
- key: NEXT_PRIVATE_AUTH_SECRET
generateValue: true
# Database — embedded Base SQLite under the persistent disk's BASE_PATH.
turbo.json
+1 -1
View File
@@ -41,7 +41,7 @@
"PORT",
"NEXT_PRIVATE_ENCRYPTION_KEY",
"NEXT_PRIVATE_ENCRYPTION_SECONDARY_KEY",
"NEXTAUTH_SECRET",
"NEXT_PRIVATE_AUTH_SECRET",
"NEXT_PUBLIC_PROJECT",
"NEXT_PUBLIC_WEBAPP_URL",
"NEXT_PRIVATE_INTERNAL_WEBAPP_URL",