chore: ignore local install dir created by installers

The install scripts default to ./cameleer/ for local install state.
Ignoring it prevents accidental commits of generated .env files,
TLS certs, and bootstrap data.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.gitignore

@@ -0,0 +1,2 @@
+# Local install state created by install.sh / install.ps1 (default --install-dir)
+/cameleer/

CLAUDE.md

@@ -31,7 +31,7 @@ Previously, SMTP env vars (`SMTP_HOST`, `SMTP_PORT`, `SMTP_USER`, `SMTP_PASS`, `
 
 ## Registry configuration
 
-The installer supports pulling images from a custom Docker registry via `--registry`. Default: `gitea.siegeln.net/cameleer`.
+The installer supports pulling images from a custom Docker registry via `--registry`. Default: `registry.cameleer.io/cameleer`.
 
 When a registry is configured, the installer writes `*_IMAGE` env vars to `.env` (e.g. `TRAEFIK_IMAGE`, `POSTGRES_IMAGE`, `CAMELEER_IMAGE`) which override the defaults baked into the compose templates. In SaaS mode, provisioning image refs (`CAMELEER_SAAS_PROVISIONING_*IMAGE`) are also set from the registry.
 

README.md

@@ -84,11 +84,10 @@ Settings can be provided via CLI flags, environment variables, config file (`cam
 
 | Setting | CLI Flag | Env Var | Config Key | Default |
 |---------|----------|---------|------------|---------|
-| Admin username | `--admin-user` | `SAAS_ADMIN_USER` | `admin_user` | `admin` |
+| Admin login | `--admin-user` | `SAAS_ADMIN_USER` | `admin_user` | `admin` (standalone) / `admin@<PUBLIC_HOST>` (SaaS) |
 | Admin password | `--admin-password` | `SAAS_ADMIN_PASS` | `admin_password` | auto-generated |
-| Admin email | `--admin-email` | `SAAS_ADMIN_EMAIL` | `admin_email` | `<username>@<PUBLIC_HOST>` |
 
-Email is the primary user identity in SaaS mode. All users — including the admin — must have an email address. If `SAAS_ADMIN_EMAIL` is not set, the bootstrap derives it from `<SAAS_ADMIN_USER>@<PUBLIC_HOST>`.
+In SaaS mode, `SAAS_ADMIN_USER` must be an email address — it is used as both the Logto username and primaryEmail. The installer validates email format in SaaS mode and auto-appends `@<PUBLIC_HOST>` if the `@` is missing. In standalone mode, any username is accepted.
 
 In standalone mode, the env vars are `SERVER_ADMIN_USER` / `SERVER_ADMIN_PASS`.
 
@@ -136,7 +135,7 @@ The Docker socket is required for tenant provisioning (SaaS mode) — the platfo
 
 | Setting | CLI Flag | Env Var | Config Key | Default |
 |---------|----------|---------|------------|---------|
-| Registry | `--registry` | `REGISTRY` | `registry` | `gitea.siegeln.net/cameleer` |
+| Registry | `--registry` | `REGISTRY` | `registry` | `registry.cameleer.io/cameleer` |
 | Registry username | `--registry-user` | `REGISTRY_USER` | `registry_user` | — |
 | Registry token | `--registry-token` | `REGISTRY_TOKEN` | `registry_token` | — |
 | Image version | `--version` | `VERSION` | `version` | `latest` |
@@ -173,7 +172,6 @@ These are generated automatically and never need to be set manually:
 
 | Secret | Env Var | Description |
 |--------|---------|-------------|
-| JWT signing secret | `CAMELEER_SERVER_SECURITY_JWTSECRET` | Shared secret for JWT token signing across provisioned tenant servers |
 | Bootstrap token | `BOOTSTRAP_TOKEN` | Server initialization token (standalone mode only) |
 
 ---

install.ps1

@@ -100,7 +100,7 @@ $script:cfg = @{
     PublicProtocol      = $PublicProtocol
     AdminUser           = $AdminUser
     AdminPass           = $AdminPassword
-    AdminEmail          = $null
+
     TlsMode             = $TlsMode
     CertFile            = $CertFile
     KeyFile             = $KeyFile
@@ -272,7 +272,7 @@ function Load-ConfigFile {
                 'public_protocol'       { if (-not $script:cfg.PublicProtocol)       { $script:cfg.PublicProtocol       = $val } }
                 'admin_user'            { if (-not $script:cfg.AdminUser)            { $script:cfg.AdminUser            = $val } }
                 'admin_password'        { if (-not $script:cfg.AdminPass)            { $script:cfg.AdminPass            = $val } }
-                'admin_email'           { if (-not $script:cfg.AdminEmail)           { $script:cfg.AdminEmail           = $val } }
+
                 'tls_mode'              { if (-not $script:cfg.TlsMode)              { $script:cfg.TlsMode              = $val } }
                 'cert_file'             { if (-not $script:cfg.CertFile)             { $script:cfg.CertFile             = $val } }
                 'key_file'              { if (-not $script:cfg.KeyFile)              { $script:cfg.KeyFile              = $val } }
@@ -305,7 +305,7 @@ function Load-EnvOverrides {
     if (-not $c.PublicProtocol)      { $c.PublicProtocol      = $_ENV_PUBLIC_PROTOCOL }
     if (-not $c.AdminUser)           { $c.AdminUser           = $env:SAAS_ADMIN_USER }
     if (-not $c.AdminPass)           { $c.AdminPass           = $env:SAAS_ADMIN_PASS }
-    if (-not $c.AdminEmail)          { $c.AdminEmail          = $env:SAAS_ADMIN_EMAIL }
+
     if (-not $c.TlsMode)             { $c.TlsMode             = $_ENV_TLS_MODE }
     if (-not $c.CertFile)            { $c.CertFile            = $_ENV_CERT_FILE }
     if (-not $c.KeyFile)             { $c.KeyFile             = $_ENV_KEY_FILE }
@@ -453,7 +453,31 @@ function Run-SimplePrompts {
 
     $c.InstallDir = Prompt-Value 'Install directory' (Coalesce $c.InstallDir $DEFAULT_INSTALL_DIR)
     $c.PublicHost = Prompt-Value 'Public hostname'   (Coalesce $c.PublicHost 'localhost')
+
+    Write-Host ''
+    Write-Host '  Deployment mode:'
+    Write-Host '    [1] Multi-tenant SaaS -- manage platform, provision tenants on demand'
+    Write-Host '    [2] Single-tenant -- one server instance, local auth, no identity provider'
+    Write-Host ''
+    $deployChoice = Read-Host '  Select mode [1]'
+    if ($deployChoice -eq '2') { $c.DeploymentMode = 'standalone' } else { $c.DeploymentMode = 'saas' }
+
+    Write-Host ''
+    if ($c.DeploymentMode -eq 'saas') {
+        $defaultEmail = Coalesce $c.AdminUser "admin@$($c.PublicHost)"
+        if ($defaultEmail -and $defaultEmail -notmatch '@.+\..+') {
+            $defaultEmail = "admin@$($c.PublicHost)"
+        }
+        while ($true) {
+            $c.AdminUser = Prompt-Value 'Admin email' $defaultEmail
+            if ($c.AdminUser -match '^[^@]+@[^@]+\.[^@]+$') { break }
+            Write-Host '  Invalid email address. Must be a valid email (e.g. admin@company.com).' -ForegroundColor Red
+            $c.AdminUser = $null
+            $defaultEmail = $null
+        }
+    } else {
         $c.AdminUser = Prompt-Value 'Admin username' (Coalesce $c.AdminUser $DEFAULT_ADMIN_USER)
+    }
 
     if (Prompt-YesNo 'Auto-generate admin password?' 'y') {
         $c.AdminPass = ''
@@ -483,14 +507,6 @@ function Run-SimplePrompts {
         $c.RegistryToken = Prompt-Password 'Registry token/password' (Coalesce $c.RegistryToken '')
     }
 
-    Write-Host ''
-    Write-Host '  Deployment mode:'
-    Write-Host '    [1] Multi-tenant SaaS -- manage platform, provision tenants on demand'
-    Write-Host '    [2] Single-tenant -- one server instance, local auth, no identity provider'
-    Write-Host ''
-    $deployChoice = Read-Host '  Select mode [1]'
-    if ($deployChoice -eq '2') { $c.DeploymentMode = 'standalone' } else { $c.DeploymentMode = 'saas' }
-
 }
  
 function Run-ExpertPrompts {
@@ -541,7 +557,15 @@ function Merge-Config {
     if (-not $c.InstallDir)          { $c.InstallDir          = $DEFAULT_INSTALL_DIR }
     if (-not $c.PublicHost)          { $c.PublicHost          = 'localhost' }
     if (-not $c.PublicProtocol)      { $c.PublicProtocol      = $DEFAULT_PUBLIC_PROTOCOL }
+    if ($c.DeploymentMode -eq 'saas') {
+        if (-not $c.AdminUser) { $c.AdminUser = "admin@$($c.PublicHost)" }
+        if ($c.AdminUser -notmatch '^[^@]+@[^@]+\.[^@]+$') {
+            Write-Host "ERROR: SAAS_ADMIN_USER must be a valid email address (e.g. admin@company.com), got: '$($c.AdminUser)'" -ForegroundColor Red
+            exit 1
+        }
+    } else {
         if (-not $c.AdminUser) { $c.AdminUser = $DEFAULT_ADMIN_USER }
+    }
     if (-not $c.TlsMode)             { $c.TlsMode             = $DEFAULT_TLS_MODE }
     if (-not $c.HttpPort)            { $c.HttpPort            = $DEFAULT_HTTP_PORT }
     if (-not $c.HttpsPort)           { $c.HttpsPort           = $DEFAULT_HTTPS_PORT }
@@ -601,7 +625,6 @@ function Validate-Config {
 function Generate-Passwords {
     $c = $script:cfg
     if (-not $c.AdminPass)          { $c.AdminPass          = Generate-Password; Log-Info 'Generated admin password.' }
-    if (-not $c.AdminEmail)         { $c.AdminEmail         = "$($c.AdminUser)@$($c.PublicHost)" }
     if (-not $c.PostgresPassword)   { $c.PostgresPassword   = Generate-Password; Log-Info 'Generated PostgreSQL password.' }
     if (-not $c.ClickhousePassword) { $c.ClickhousePassword = Generate-Password; Log-Info 'Generated ClickHouse password.' }
 }
@@ -635,7 +658,6 @@ function Generate-EnvFile {
     $ts  = (Get-Date -Format 'yyyy-MM-dd HH:mm:ss') + ' UTC'
     $bt  = Generate-Password
  
-    $jwtSecret = Generate-Password
 
     if ($c.DeploymentMode -eq 'standalone') {
         $content = @"
@@ -658,9 +680,6 @@ SERVER_ADMIN_USER=$($c.AdminUser)
 # Bootstrap token
 BOOTSTRAP_TOKEN=$bt
 
-# JWT signing secret (required by server, must be non-empty)
-CAMELEER_SERVER_SECURITY_JWTSECRET=$jwtSecret
-
 # Docker
 DOCKER_SOCKET=$($c.DockerSocket)
 DOCKER_GID=$gid
@@ -712,7 +731,6 @@ POSTGRES_DB=cameleer_saas
 
 # Admin user
 SAAS_ADMIN_USER=$($c.AdminUser)
-SAAS_ADMIN_EMAIL=$($c.AdminEmail)
 
 # TLS
 NODE_TLS_REJECT=$($c.NodeTlsReject)
@@ -741,8 +759,6 @@ CAMELEER_SAAS_PROVISIONING_SERVERIMAGE=$reg/cameleer-server:$($c.Version)
 CAMELEER_SAAS_PROVISIONING_SERVERUIIMAGE=$reg/cameleer-server-ui:$($c.Version)
 CAMELEER_SAAS_PROVISIONING_RUNTIMEBASEIMAGE=$reg/cameleer-runtime-base:$($c.Version)
 
-# JWT signing secret (forwarded to provisioned tenant servers, must be non-empty)
-CAMELEER_SERVER_SECURITY_JWTSECRET=$jwtSecret
 "@
         $content += $provisioningBlock
         # Passwords appended with single-quoting for special character safety
@@ -976,7 +992,6 @@ public_host=$($c.PublicHost)
 auth_host=$($c.AuthHost)
 public_protocol=$($c.PublicProtocol)
 admin_user=$($c.AdminUser)
-admin_email=$($c.AdminEmail)
 tls_mode=$($c.TlsMode)
 http_port=$($c.HttpPort)
 https_port=$($c.HttpsPort)
@@ -1037,7 +1052,6 @@ ClickHouse:       default / $($c.ClickhousePassword)
 Admin Console:  $($c.PublicProtocol)://$($c.PublicHost)/platform/
 Admin User:     $($c.AdminUser)
 Admin Password: $($c.AdminPass)
-Admin Email:    $($c.AdminEmail)
 
 PostgreSQL:     cameleer / $($c.PostgresPassword)
 ClickHouse:     default / $($c.ClickhousePassword)
@@ -1341,7 +1355,6 @@ function Print-Credentials {
     }
     Write-Host "  Admin User:     $($c.AdminUser)"
     Write-Host "  Admin Password: $($c.AdminPass)"
-    Write-Host "  Admin Email:    $($c.AdminEmail)"
     Write-Host ''
     Write-Host "  PostgreSQL:     cameleer / $($c.PostgresPassword)"
     Write-Host "  ClickHouse:     default / $($c.ClickhousePassword)"

install.sh

@@ -56,7 +56,7 @@ AUTH_HOST=""
 PUBLIC_PROTOCOL=""
 ADMIN_USER=""
 ADMIN_PASS=""
-ADMIN_EMAIL=""
+
 TLS_MODE=""
 CERT_FILE=""
 KEY_FILE=""
@@ -169,7 +169,7 @@ parse_args() {
       --public-protocol)  PUBLIC_PROTOCOL="$2"; shift ;;
       --admin-user)       ADMIN_USER="$2"; shift ;;
       --admin-password)   ADMIN_PASS="$2"; shift ;;
-      --admin-email)      ADMIN_EMAIL="$2"; shift ;;
+
       --tls-mode)         TLS_MODE="$2"; shift ;;
       --cert-file)        CERT_FILE="$2"; shift ;;
       --key-file)         KEY_FILE="$2"; shift ;;
@@ -264,7 +264,7 @@ load_config_file() {
       public_protocol)      [ -z "$PUBLIC_PROTOCOL" ] && PUBLIC_PROTOCOL="$value" ;;
       admin_user)           [ -z "$ADMIN_USER" ] && ADMIN_USER="$value" ;;
       admin_password)       [ -z "$ADMIN_PASS" ] && ADMIN_PASS="$value" ;;
-      admin_email)          [ -z "$ADMIN_EMAIL" ] && ADMIN_EMAIL="$value" ;;
+
       tls_mode)             [ -z "$TLS_MODE" ] && TLS_MODE="$value" ;;
       cert_file)            [ -z "$CERT_FILE" ] && CERT_FILE="$value" ;;
       key_file)             [ -z "$KEY_FILE" ] && KEY_FILE="$value" ;;
@@ -295,7 +295,7 @@ load_env_overrides() {
   [ -z "$PUBLIC_PROTOCOL" ] && PUBLIC_PROTOCOL="$_ENV_PUBLIC_PROTOCOL"
   [ -z "$ADMIN_USER" ] && ADMIN_USER="${SAAS_ADMIN_USER:-}"
   [ -z "$ADMIN_PASS" ] && ADMIN_PASS="${SAAS_ADMIN_PASS:-}"
-  [ -z "$ADMIN_EMAIL" ] && ADMIN_EMAIL="${SAAS_ADMIN_EMAIL:-}"
+
   [ -z "$TLS_MODE" ] && TLS_MODE="$_ENV_TLS_MODE"
   [ -z "$CERT_FILE" ] && CERT_FILE="$_ENV_CERT_FILE"
   [ -z "$KEY_FILE" ] && KEY_FILE="$_ENV_KEY_FILE"
@@ -429,7 +429,37 @@ run_simple_prompts() {
 
   prompt INSTALL_DIR "Install directory" "${INSTALL_DIR:-$DEFAULT_INSTALL_DIR}"
   prompt PUBLIC_HOST "Public hostname" "${PUBLIC_HOST:-localhost}"
+
+  echo ""
+  echo "  Deployment mode:"
+  echo "    [1] Multi-tenant SaaS — manage platform, provision tenants on demand"
+  echo "    [2] Single-tenant — one server instance, local auth, no identity provider"
+  echo ""
+  local deploy_choice
+  read -rp "  Select mode [1]: " deploy_choice
+  case "${deploy_choice:-1}" in
+    2)
+      DEPLOYMENT_MODE="standalone"
+      ;;
+    *)
+      DEPLOYMENT_MODE="saas"
+      ;;
+  esac
+
+  echo ""
+  if [ "$DEPLOYMENT_MODE" = "saas" ]; then
+    while true; do
+      prompt ADMIN_USER "Admin email" "${ADMIN_USER:-admin@${PUBLIC_HOST:-localhost}}"
+      # Validate email: must be user@domain.tld format
+      if echo "$ADMIN_USER" | grep -qE '^[^@]+@[^@]+\.[^@]+$'; then
+        break
+      fi
+      echo -e "  ${RED}Invalid email address.${NC} Must be a valid email (e.g. admin@company.com)."
+      ADMIN_USER=""
+    done
+  else
     prompt ADMIN_USER "Admin username" "${ADMIN_USER:-$DEFAULT_ADMIN_USER}"
+  fi
 
   if prompt_yesno "Auto-generate admin password?" "y"; then
     ADMIN_PASS=""
@@ -459,22 +489,6 @@ run_simple_prompts() {
     prompt_password REGISTRY_TOKEN "Registry token/password" "${REGISTRY_TOKEN:-}"
   fi
 
-  echo ""
-  echo "  Deployment mode:"
-  echo "    [1] Multi-tenant SaaS — manage platform, provision tenants on demand"
-  echo "    [2] Single-tenant — one server instance, local auth, no identity provider"
-  echo ""
-  local deploy_choice
-  read -rp "  Select mode [1]: " deploy_choice
-  case "${deploy_choice:-1}" in
-    2)
-      DEPLOYMENT_MODE="standalone"
-      ;;
-    *)
-      DEPLOYMENT_MODE="saas"
-      ;;
-  esac
-
 }
 
 run_expert_prompts() {
@@ -526,7 +540,16 @@ merge_config() {
   : "${INSTALL_DIR:=$DEFAULT_INSTALL_DIR}"
   : "${PUBLIC_HOST:=localhost}"
   : "${PUBLIC_PROTOCOL:=$DEFAULT_PUBLIC_PROTOCOL}"
+  if [ "$DEPLOYMENT_MODE" = "saas" ]; then
+    : "${ADMIN_USER:=admin@${PUBLIC_HOST}}"
+    # Validate email format in SaaS mode
+    if ! echo "$ADMIN_USER" | grep -qE '^[^@]+@[^@]+\.[^@]+$'; then
+      echo -e "${RED}ERROR:${NC} SAAS_ADMIN_USER must be a valid email address (e.g. admin@company.com), got: '$ADMIN_USER'" >&2
+      exit 1
+    fi
+  else
     : "${ADMIN_USER:=$DEFAULT_ADMIN_USER}"
+  fi
   : "${TLS_MODE:=$DEFAULT_TLS_MODE}"
   : "${HTTP_PORT:=$DEFAULT_HTTP_PORT}"
   : "${HTTPS_PORT:=$DEFAULT_HTTPS_PORT}"
@@ -601,9 +624,7 @@ generate_passwords() {
     ADMIN_PASS=$(generate_password)
     log_info "Generated admin password."
   fi
-  if [ -z "$ADMIN_EMAIL" ]; then
+
-    ADMIN_EMAIL="${ADMIN_USER}@${PUBLIC_HOST:-localhost}"
-  fi
   if [ -z "$POSTGRES_PASSWORD" ]; then
     POSTGRES_PASSWORD=$(generate_password)
     log_info "Generated PostgreSQL password."
@@ -651,9 +672,6 @@ SERVER_ADMIN_USER=${ADMIN_USER}
 # Bootstrap token (required by server, not used externally in standalone mode)
 BOOTSTRAP_TOKEN=$(generate_password)
 
-# JWT signing secret (required by server, must be non-empty)
-CAMELEER_SERVER_SECURITY_JWTSECRET=$(generate_password)
-
 # Docker
 DOCKER_SOCKET=${DOCKER_SOCKET}
 DOCKER_GID=$(stat -c '%g' "${DOCKER_SOCKET}" 2>/dev/null || echo "0")
@@ -712,7 +730,6 @@ POSTGRES_DB=cameleer_saas
 
 # Admin user
 SAAS_ADMIN_USER=${ADMIN_USER}
-SAAS_ADMIN_EMAIL=${ADMIN_EMAIL}
 
 # TLS
 NODE_TLS_REJECT=${NODE_TLS_REJECT}
@@ -746,9 +763,6 @@ CAMELEER_SAAS_PROVISIONING_SERVERIMAGE=${REGISTRY}/cameleer-server:${VERSION}
 CAMELEER_SAAS_PROVISIONING_SERVERUIIMAGE=${REGISTRY}/cameleer-server-ui:${VERSION}
 CAMELEER_SAAS_PROVISIONING_RUNTIMEBASEIMAGE=${REGISTRY}/cameleer-runtime-base:${VERSION}
 
-# JWT signing secret (forwarded to provisioned tenant servers, must be non-empty)
-CAMELEER_SERVER_SECURITY_JWTSECRET=$(generate_password)
-
 # Compose file assembly
 COMPOSE_FILE=docker-compose.yml:docker-compose.saas.yml$([ "$TLS_MODE" = "custom" ] && echo ":docker-compose.tls.yml")$([ -n "$MONITORING_NETWORK" ] && echo ":docker-compose.monitoring.yml")
 EOF
@@ -926,7 +940,6 @@ public_host=${PUBLIC_HOST}
 auth_host=${AUTH_HOST}
 public_protocol=${PUBLIC_PROTOCOL}
 admin_user=${ADMIN_USER}
-admin_email=${ADMIN_EMAIL}
 tls_mode=${TLS_MODE}
 http_port=${HTTP_PORT}
 https_port=${HTTPS_PORT}
@@ -983,7 +996,6 @@ EOF
 Admin Console:  ${PUBLIC_PROTOCOL}://${PUBLIC_HOST}/platform/
 Admin User:     ${ADMIN_USER}
 Admin Password: ${ADMIN_PASS}
-Admin Email:     ${ADMIN_EMAIL}
 
 PostgreSQL:     cameleer / ${POSTGRES_PASSWORD}
 ClickHouse:     default / ${CLICKHOUSE_PASSWORD}
@@ -1301,7 +1313,6 @@ print_credentials() {
   fi
   echo -e "  Admin User:     ${BOLD}${ADMIN_USER}${NC}"
   echo -e "  Admin Password: ${BOLD}${ADMIN_PASS}${NC}"
-  echo -e "  Admin Email:     ${BOLD}${ADMIN_EMAIL}${NC}"
   echo ""
   echo -e "  PostgreSQL:     cameleer / ${POSTGRES_PASSWORD}"
   echo -e "  ClickHouse:     default / ${CLICKHOUSE_PASSWORD}"

templates/.env.example

@@ -50,11 +50,10 @@ CLICKHOUSE_PASSWORD=CHANGE_ME
 # ============================================================
 # Admin credentials (SaaS mode)
 # ============================================================
-# Email is the primary user identity in SaaS mode. The admin email
+# In SaaS mode, this must be an email address (primary user identity).
-# defaults to <SAAS_ADMIN_USER>@<PUBLIC_HOST> if not set explicitly.
+# In standalone mode, any username is accepted.
-SAAS_ADMIN_USER=admin
+SAAS_ADMIN_USER=admin@example.com
 SAAS_ADMIN_PASS=CHANGE_ME
-# SAAS_ADMIN_EMAIL=admin@example.com
 
 # ============================================================
 # Admin credentials (standalone mode)

templates/docker-compose.saas.yml

@@ -27,7 +27,6 @@ services:
       PG_DB_SAAS: cameleer_saas
       SAAS_ADMIN_USER: ${SAAS_ADMIN_USER:-admin}
       SAAS_ADMIN_PASS: ${SAAS_ADMIN_PASS:?SAAS_ADMIN_PASS must be set in .env}
-      SAAS_ADMIN_EMAIL: ${SAAS_ADMIN_EMAIL:-}
     extra_hosts:
       # Logto validates M2M tokens by fetching its own JWKS from ENDPOINT.
       # Route the public hostname back to the Docker host (Traefik on :443)
@@ -86,7 +85,6 @@ services:
       CAMELEER_SAAS_PROVISIONING_DATASOURCEUSERNAME: ${POSTGRES_USER:-cameleer}
       CAMELEER_SAAS_PROVISIONING_DATASOURCEPASSWORD: ${POSTGRES_PASSWORD}
       CAMELEER_SAAS_PROVISIONING_CLICKHOUSEPASSWORD: ${CLICKHOUSE_PASSWORD}
-      CAMELEER_SERVER_SECURITY_JWTSECRET: ${CAMELEER_SERVER_SECURITY_JWTSECRET:?CAMELEER_SERVER_SECURITY_JWTSECRET must be set in .env}
       CAMELEER_SAAS_PROVISIONING_SERVERIMAGE: ${CAMELEER_SAAS_PROVISIONING_SERVERIMAGE:-registry.cameleer.io/cameleer/cameleer-server:latest}
       CAMELEER_SAAS_PROVISIONING_SERVERUIIMAGE: ${CAMELEER_SAAS_PROVISIONING_SERVERUIIMAGE:-registry.cameleer.io/cameleer/cameleer-server-ui:latest}
       CAMELEER_SAAS_PROVISIONING_RUNTIMEBASEIMAGE: ${CAMELEER_SAAS_PROVISIONING_RUNTIMEBASEIMAGE:-registry.cameleer.io/cameleer/cameleer-runtime-base:latest}

templates/docker-compose.server.yml

@@ -29,7 +29,6 @@ services:
       CAMELEER_SERVER_CLICKHOUSE_USERNAME: default
       CAMELEER_SERVER_CLICKHOUSE_PASSWORD: ${CLICKHOUSE_PASSWORD}
       CAMELEER_SERVER_SECURITY_BOOTSTRAPTOKEN: ${BOOTSTRAP_TOKEN:?BOOTSTRAP_TOKEN must be set in .env}
-      CAMELEER_SERVER_SECURITY_JWTSECRET: ${CAMELEER_SERVER_SECURITY_JWTSECRET:?CAMELEER_SERVER_SECURITY_JWTSECRET must be set in .env}
       CAMELEER_SERVER_SECURITY_UIUSER: ${SERVER_ADMIN_USER:-admin}
       CAMELEER_SERVER_SECURITY_UIPASSWORD: ${SERVER_ADMIN_PASS:?SERVER_ADMIN_PASS must be set in .env}
       CAMELEER_SERVER_SECURITY_CORSALLOWEDORIGINS: ${PUBLIC_PROTOCOL:-https}://${PUBLIC_HOST:-localhost}