TrueNAS App Secret Key?

[AcrimoniousMirth]

Hi!
The official TrueNAS app is asking for a 64 character secret key in order to complete setup.

Help: Secret Key
The secret key for AIOStreams (create with openssl rand -hex 32).

I can't find any reference to it in the AIOStreams configurator or documentation, at least none that I can make out. Has anyone got clarity on what it's expecting here and how it ties to the config I made?

Many thanks!

[Maxaubert]

It's not something you get from the configurator. It's a server-side setting (the SECRET_KEY environment variable) that you generate yourself, once, and it isn't tied to any particular config you made.

AIOStreams uses it to derive the key that encrypts stored configurations (it is also mixed into the key derived from each user's password, and used to sign some internal tokens). So any random 64-character hex string works.

Generate one with:

openssl rand -hex 32

or, if you don't have openssl handy:

node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"

Paste the output into the TrueNAS field. Two things to watch out for:

• It has to be exactly 64 hex characters (0-9, a-f), otherwise the validator rejects it.
• Keep a copy of it. It can't be changed after the first run: stored configs are encrypted with it, so changing it means existing configs can no longer be decrypted.

Source for the definition and description:

AIOStreams/packages/core/src/utils/env.ts

Lines 226 to 229 in 3c23fd4

	SECRET_KEY: secretKey({
	desc: 'Session/encryption secret used to derive keys for stored configurations. Must be a 64-character hex string. Generate with `openssl rand -hex 32`. Cannot be changed after first run. (Legacy alias `SESSION_SECRET` is still accepted for one minor release.)',
	example: 'Generate using: openssl rand -hex 32',
	}),

And where it's used as the AES key:

AIOStreams/packages/core/src/utils/crypto.ts

Lines 94 to 96 in 3c23fd4

	export function encryptString(data: string, secretKey?: Buffer): Response {
	if (!secretKey) {
	secretKey = Buffer.from(appConfig.bootstrap.secretKey, 'hex');