From 28584e31c622c0f8984c8e9d9064319472464cb7 Mon Sep 17 00:00:00 2001 From: Sean O'Connor Date: Wed, 9 Sep 2026 18:01:08 -0400 Subject: [PATCH] Document Garage key initialization in Coolify --- docs/deployment.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/docs/deployment.md b/docs/deployment.md index 30e8949..2cb223c 100644 --- a/docs/deployment.md +++ b/docs/deployment.md @@ -12,6 +12,10 @@ to the app/auth and browser storage endpoint respectively. Route web to port services are public; do not expose Postgres or Garage's admin/RPC ports. Set `EMAIL_FROM`, `RESEND_API_KEY`, and `RESEND_WEBHOOK_SECRET` in Coolify before starting. Generated credentials belong to this stack, not other applications. +Coolify does not generate 24-character hex values automatically: initialize +`SERVICE_HEX_24_S3KEY` with 12 cryptographically random bytes encoded as hex +before the first deployment. The Compose file adds Garage's `GK` prefix. +Keep that identifier and all storage secrets stable across redeployments. Keep worker concurrency at one initially on a shared VM. Back up all three data volumes off-host and verify recovery before collecting real wedding photos.