coinos-server.git/config.ts.sample, branch mastercoinos server — legacy coinos.io backend (Lightning, on-chain, Liquid)https://git.coinos.io/coinos-server.git/atom?h=master2026-08-08T06:29:25Zauth: fail closed on adminpass, scrub sample secrets (S3)2026-08-08T06:29:25ZAdam Soltysadam@coinos.io2026-08-08T05:59:21Zurn:sha1:d513ab75131bfaa16b1f0820d0fb18ad9e7f6ab1
The master-password path (isAdmin = password === config.adminpass) logs
in as any user, skipping password, 2FA, and captcha. Worse, when
adminpass is unset an omitted password field made undefined === undefined
true, authenticating as anyone. Require both the configured value and the
supplied password to be non-empty and match exactly, across every
adminpass comparison (login, recaptcha bypass, support email, freeze).
Also scrub config.ts.sample: the sample shipped a working-looking JWT
secret, two server nsec keys, and adminpass "pwa". Replace with
fail-closed placeholders and regenerate instructions. Rotate any
deployment that ever shipped the sample values.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
rotate server key2025-09-30T04:50:57ZAdam Soltysadam@coinos.io2025-09-30T04:47:18Zurn:sha1:481dec5b1cfa2a085dda500ce0c390b38cb4a8b0catch errors in pay_invoice2025-09-30T04:17:41ZAdam Soltysadam@coinos.io2025-09-30T04:14:43Zurn:sha1:c901c9571ff9406188a8bbb68c701ad3b21c24ebclb socket2025-08-21T19:46:17ZAdam Soltysadam@coinos.io2025-08-21T19:46:17Zurn:sha1:85c40814aec0be2c77a801a84d100937e6396543square env2025-08-21T19:38:19ZAdam Soltysadam@coinos.io2025-08-21T19:38:19Zurn:sha1:b71a225d8b09a860085c72f1084a220ed2edec5asquare sample config2025-08-21T19:36:37ZAdam Soltysadam@coinos.io2025-08-21T19:36:37Zurn:sha1:47f3e702bcfe69da24498fe24da9d472afe2efe2Initial server setup fixes2024-10-02T20:38:27Zndungudedandnkibere@gmail.com2024-10-02T20:38:27Zurn:sha1:091253441cb06ae75ddaceb5a3efa2376526328erm jimp2024-09-09T05:15:37ZAdam Soltysasoltys@gmail.com2024-09-09T05:15:37Zurn:sha1:95e4faa6413d9b9ec5975dc6410bd5b6a9c648d0add mint to sample config2024-09-05T19:15:18ZAdam Soltysasoltys@gmail.com2024-09-05T19:15:18Zurn:sha1:81ae64ff4aae2021c97f7e504ae55a733f74c8deupdate sample config2024-09-05T19:12:39ZAdam Soltysasoltys@gmail.com2024-09-05T19:12:39Zurn:sha1:ac63d9cb30690f335616aa046e2b6512b05ecb44