[kh0pper]

This PR is stacked on #504 (fix/bundle-generated-secrets). Merge #504 first, then retarget this one to main.

Queue item 30, fix C (one-click audit). The installer copied .env.example example values as if they were real config, and "Finish setup" counted them as filled. The result was fake media paths that Docker created as root, *.example.com domains, and a tax encryption key published in this public repo.

What changes

• Detecting example values. servers/gateway/bundle-env-placeholders.js recognises them by shape: /path/to/, youruser, your-, *.example.com (including @x:example.com), change-me, replace-me, <…>, xxx, placeholder. It also recognises example secrets once published here, by SHA-256 only.
• Install. When the installer builds .env from .env.example, it turns example-value lines into comments that name only the key. An existing .env is never rewritten.
• Default library folders. New env_vars[].default_in_crow_home field. A blank or example path becomes a folder inside this instance's CROW_HOME, created by the gateway (never by Docker as root). It is never copied to the shared gateway .env, and it no longer blocks install.
  • jellyfin uses media/jellyfin and navidrome media/music.
  • On uninstall the path is kept in the retained copy, so reinstalling over kept data reuses it.
• "Finish setup" lists a required key whose value is an example. Existing installs are flagged this way; their .env is not rewritten.
• tax:
  • It never encrypts with the published example key (matched by hash only, never by a passphrase's shape); decrypting old data still works.
  • CROW_TAX_ENCRYPTION_KEY_PREVIOUS opens returns saved with an earlier key. Configure fills that slot with the outgoing key when it is empty, never overwrites a different kept key, and warns instead.
  • At start the tax server moves returns to the current key with a compare-and-swap, so a save made in the meantime wins.
  • server.envKeys now include both keys, so a typed key reaches the server. Before, it never did.
• Domains. gotosocial, writefreely and matrix-dendrite refuse to start with a blank domain (${X:?}), and the fields say the domain is fixed at first start. GTS_ACCOUNT_DOMAIN is optional.
• .env.example files no longer carry example domains, paths or secrets as live values; they are kept as commented examples.

Not in this PR

• plex: its manifest is also bumped by the install-guard PR. It follows once that lands.
• Generated keys that hold an example value are not flagged. The known case is grackle's romm ROMM_AUTH_SECRET_KEY, which needs an operator rotation.
• Static :-changeme compose fallbacks (peertube, frigate, minio).
• Uninstall deletes the tax key while the encrypted data stays.

Existing installs are never rewritten. Placeholders show up in "Finish setup".

Tests

• New: tests/bundle-env-placeholders.test.js. It covers the detector, the scrub, install rungs, default folders and reinstall reuse, a collection-style jellyfin install, needsConfigKeys, a lint over all .env.example files, and tax encrypt/decrypt, fallback, re-encryption and race handling, plus the Configure key change.
• Updated: bundles-install-hardening.
• Full suite (with fix(bundles): generate the admin passwords Crow can choose, and save them to the keychain #504): 9553 tests, 0 failures.

Version bumps: jellyfin 1.0.2, navidrome 1.0.2, audiobookshelf 1.0.1, kavita 1.0.1, calibre-server 1.0.1, calibre-web 1.0.1, gotosocial 1.0.2, matrix-dendrite 1.0.4, writefreely 1.0.3, tax 2.0.3, nextcloud 1.1.1. The registry is rebuilt.

Deploy: gateway code. Restart crow-gateway, plus r4's gateway on the same tree. Deploy together with #504.

https://claude.ai/code/session_01N9fXzvNy8rCEArj1y5p6fp