security: remove DW2024! hardcoded creds from pm2 WRAP — now sourced from secrets .env at runtime (TK-10045/TK-10071)

3e7e390205bda385b7bef2fc47c0575955ee5653 · 2026-07-31 04:05:50 -0700 · Steve

Files touched

M start-fleet-persistent.sh

Diff

commit 3e7e390205bda385b7bef2fc47c0575955ee5653
Author: Steve <steve@designerwallcoverings.com>
Date:   Fri Jul 31 04:05:50 2026 -0700

    security: remove DW2024! hardcoded creds from pm2 WRAP — now sourced from secrets .env at runtime (TK-10045/TK-10071)
---
 start-fleet-persistent.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/start-fleet-persistent.sh b/start-fleet-persistent.sh
index 32b6f36..15ceb6f 100755
--- a/start-fleet-persistent.sh
+++ b/start-fleet-persistent.sh
@@ -35,7 +35,7 @@ for slug in "${SLUGS[@]}"; do
   NAME="dwtool-$slug"
   # child self-sources ALL secrets at runtime (matches the hub's own loadSecretsEnv), sets
   # DRY_RUN=1 so taggers/updaters never push, then runs the tool's own start command.
-  WRAP="set -a; [ -f '$SECRETS' ] && . '$SECRETS'; set +a; export DRY_RUN=1 ADMIN_PASSWORD='DW2024!' DW_BASIC_AUTH='admin:DW2024!' VISION_SCAN_CAP=25 NEXTAUTH_URL='http://localhost:$PORT'; $START"
+  WRAP="set -a; [ -f '$SECRETS' ] && . '$SECRETS'; set +a; export DRY_RUN=1 VISION_SCAN_CAP=25 NEXTAUTH_URL='http://localhost:$PORT'; $START"
   pm2 delete "$NAME" >/dev/null 2>&1
   if pm2 start bash --name "$NAME" -- -lc "$WRAP" >/dev/null 2>&1; then echo "up   $NAME (:$PORT)"; else echo "FAIL $NAME"; fi
 done

← fda8808 tools-dw-hub deploy: INSTALL_CMD=true (no npm deps → npm ci · back to Tools Dw Hub · tools-dw-hub: href-drill — card category is a filter-link + 1b68235 →