Versions 0.26+ not working with k8s due to auth pepper api var

[greenship24]

First Check

• This is not a feature request
• I added a very descriptive title to this issue.
• I used the GitHub search to find a similar issue and didn't find it.
• I searched the documentation, with the integrated search.
• I already read the docs and didn't find an answer.
• I can replicate the issue inside the Demo install.

Homebox Version

v0.26.2-rootless

What is the issue you are experiencing?

Error

panic: auth.api_key_pepper must be set to at least 32 bytes; generate with openssl rand -base64 48 and provide via HBOX_AUTH_API_KEY_PEPPER. Rotating it invalidates all issued API keys

Details about environment

Anyone running K8s knows that it base64 encodes all vars. I am running 25.x on my prod and looking to go 0.26.2 on testing to verify it all works, etc.

Process

• Generate the key with the instructions- openssl rand -base64 48
• Base64 encode it - echo <that output> | base64
• Place that output into my actual secret (using sops) - HBOX_AUTH_API_KEY_PEPPER: <the twice base64 encoded output>

Result

Still does not work and fails with the same error. Realistically nothing should be wrong with it now. I can verify the secret itself shows the base64 value it should have. Is there any strictness on what this value can/should be besides 32 bytes? I tried with openssl rand -hex 40 and it failed as well.

How can the maintainer reproduce the issue?

Do as above

Deployment

Docker (Linux)

Database Type

SQLite

OS Architechture

x86_64 (AMD, Intel)

Deployment Details

No response

[coderabbitai]

⚠️ Possible Duplicate Issue(s)

• Versions 0.26+ not working with Tailscale sidecar setup #1560

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

[greenship24]

Also, I searched and saw the suggested duplicate issue but that is not related at all (indeed where I got part of the title from).

[tankerkiller125]

Any random input will do, the openssl rand -base64 48 is simply a quick suggestion.

So long as the total string length is over 32 bytes it should work. I don't have any experience with k8s, and unfortunately, I don't think anyone else on the team does either.

[greenship24]

Oddly enough it seems to work with a standard environment variable (ie. not in a secret like it should be). Let me keep testing to figure it out. Hope to respond back soon enough.

[greenship24]

Ugh- operator error. I'll be closing this out.

Evidently when I installed homebox I had used an older template for my k8s setup (kustomize but I didn't include all secrets from the secret file that is generated by default (using envFrom) - on this template I was specifying them manually).

Once I pulled it in-

            - name: HBOX_AUTH_API_KEY_PEPPER
              valueFrom:
                secretKeyRef:
                  name: homebox-secret
                  key: HBOX_AUTH_API_KEY_PEPPER

it started just fine.

Apologies for the errant issue. Should've checked myself a bit before opening but maybe it'll help someone in the future.