deprecate secret key for paseto private

Author: pierre-b

.github/workflows/go.yml

@@ -34,7 +34,6 @@ jobs:
           echo "PASETO_PRIVATE_KEY=UayDa4OMDpm3CvIT+iSC39iDyPlsui0pNQYDEZ1pbo1LsIrO4p/aVuCBWz6LiYvzj9pc+gn0gLwRd0CoHV+nxw==" >> .env.test
           echo "PASETO_PUBLIC_KEY=S7CKzuKf2lbggVs+i4mL84/aXPoJ9IC8EXdAqB1fp8c=" >> .env.test
           echo "ROOT_EMAIL=admin@example.com" >> .env.test
-          echo "SECRET_KEY=test-key" >> .env.test
 
           # Run unit tests (exclude integration tests)
           go test -race -coverprofile=coverage-unit.txt -covermode=atomic $(go list ./... | grep -v '/tests/integration') -v 
@@ -126,7 +125,6 @@ jobs:
           echo "PASETO_PRIVATE_KEY=UayDa4OMDpm3CvIT+iSC39iDyPlsui0pNQYDEZ1pbo1LsIrO4p/aVuCBWz6LiYvzj9pc+gn0gLwRd0CoHV+nxw==" >> .env.test
           echo "PASETO_PUBLIC_KEY=S7CKzuKf2lbggVs+i4mL84/aXPoJ9IC8EXdAqB1fp8c=" >> .env.test
           echo "ROOT_EMAIL=admin@example.com" >> .env.test
-          echo "SECRET_KEY=test-key" >> .env.test
           echo "DB_HOST=localhost" >> .env.test
           echo "DB_PORT=5433" >> .env.test
           echo "DB_USER=notifuse_test" >> .env.test

Makefile

@@ -50,7 +50,6 @@ docker-run:
 		-p 8080:8080 \
 		-e PASETO_PRIVATE_KEY=$${PASETO_PRIVATE_KEY} \
 		-e PASETO_PUBLIC_KEY=$${PASETO_PUBLIC_KEY} \
-		-e SECRET_KEY=$${SECRET_KEY} \
 		-e ROOT_EMAIL=$${ROOT_EMAIL:-admin@example.com} \
 		-e API_ENDPOINT=$${API_ENDPOINT:-http://localhost:8080} \
 		-e WEBHOOK_ENDPOINT=$${WEBHOOK_ENDPOINT:-http://localhost:8080} \

README.md

@@ -98,7 +98,15 @@ Notifuse follows clean architecture principles with clear separation of concerns
    ```
 
 3. **Generate PASETO keys**:
-   Visit [paseto.notifuse.com](https://paseto.notifuse.com) to generate your PASETO keys
+   Visit [paseto.notifuse.com](https://paseto.notifuse.com) to generate your PASETO keys, or use the built-in keygen command:
+
+   ```bash
+   # Generate keys manually
+   make keygen
+
+   # Or directly with Go
+   go run cmd/keygen/main.go
+   ```
 
 4. **Start the services**:
 
@@ -127,7 +135,7 @@ The docker-compose includes a PostgreSQL container for quick testing. Simply run
 
 Copy `env.example` to `.env` and configure:
 
-- **Required**: `ROOT_EMAIL`, `API_ENDPOINT`, `PASETO_PRIVATE_KEY`, `PASETO_PUBLIC_KEY`, `SECRET_KEY`
+- **Required**: `ROOT_EMAIL`, `API_ENDPOINT`, `PASETO_PRIVATE_KEY`, `PASETO_PUBLIC_KEY`
 - **Database**: Configure `DB_HOST`, `DB_USER`, `DB_PASSWORD` for your external PostgreSQL
 - **SMTP Settings**: Configure your email provider for system emails
 - **SSL**: Set `DB_SSLMODE=require` for secure database connections

TODO.md

@@ -1,6 +1,13 @@
 # TODO
 
-- docs: newsletter input form example
+- store last cron timestamp in DB and render an alert if it's not running (only in production)
+- better design for system email
+- double opt in template for newsletter
+- welcome template for notifuse newsletter
+- page vs loops.so
+- page vs listmonk
+- page vs mailerlite
+- page vs mautic
 
 ## Eventual features
 

config/config.go

@@ -10,7 +10,7 @@ import (
 	"github.com/spf13/viper"
 )
 
-const VERSION = "3.2"
+const VERSION = "3.3"
 
 type Config struct {
 	Server          ServerConfig
@@ -242,8 +242,11 @@ func LoadWithOptions(opts LoadOptions) (*Config, error) {
 		return nil, fmt.Errorf("error creating PASETO public key: %w", err)
 	}
 
-	if v.GetString("SECRET_KEY") == "" {
-		return nil, fmt.Errorf("SECRET_KEY is required")
+	// Use PASETO private key as secret key if SECRET_KEY is not provided
+	secretKey := v.GetString("SECRET_KEY")
+	if secretKey == "" {
+		// Use base64 encoded PASETO private key as the secret key
+		secretKey = privateKeyBase64
 	}
 
 	config := &Config{
@@ -278,7 +281,7 @@ func LoadWithOptions(opts LoadOptions) (*Config, error) {
 			PasetoPublicKey:       publicKey,
 			PasetoPrivateKeyBytes: privateKeyBytes,
 			PasetoPublicKeyBytes:  publicKeyBytes,
-			SecretKey:             v.GetString("SECRET_KEY"),
+			SecretKey:             secretKey,
 		},
 		Demo: DemoConfig{
 			FileManagerEndpoint:  v.GetString("DEMO_FILE_MANAGER_ENDPOINT"),

docker-compose.yml

@@ -20,7 +20,6 @@ services:
       - ENVIRONMENT=production
       - PASETO_PRIVATE_KEY=${PASETO_PRIVATE_KEY:-d04zCk3Fa45oOjDWHpAvc1AZxnLdGffOnNWK+Jt2yXf37+FTfuMMHb8flcfPMqLluRR3rvhbr555r6j1DEigrA==}
       - PASETO_PUBLIC_KEY=${PASETO_PUBLIC_KEY:-9+/hU37jDB2/H5XHzzKi5bkUd674W6+eea+o9QxIoKw=}
-      - SECRET_KEY=${SECRET_KEY:-change_me_32_character_secret_key}
       - ROOT_EMAIL=${ROOT_EMAIL:-admin@example.com}
       - SMTP_HOST=${SMTP_HOST:-smtp.example.com}
       - SMTP_PORT=${SMTP_PORT:-587}

env.example

@@ -21,9 +21,6 @@ API_ENDPOINT=https://emails.yourcompany.com
 PASETO_PRIVATE_KEY=your_base64_encoded_private_key_here
 PASETO_PUBLIC_KEY=your_base64_encoded_public_key_here
 
-# Secret key for database encryption (32 characters minimum)
-SECRET_KEY=your_32_character_secret_key_here_123
-
 # SMTP Configuration for system emails (password resets, invitations, etc.)
 SMTP_HOST=smtp.gmail.com
 SMTP_PORT=587