fix: single-quote passwords in .env to handle special characters

Passwords with $, &, ;, [, etc. were written unquoted to .env and cameleer.conf, causing Docker Compose to mangle them. Now all password and secret fields are written as KEY='value' with embedded single quotes escaped as '\''. Also removes inline DB_URL from docker-compose.saas.yml — the Logto entrypoint now builds it from PG_USER/PG_PASSWORD/PG_HOST using node's encodeURIComponent for URL-safe encoding. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
fix: make get-cameleer.ps1 safe under irm | iex
2026-04-25 16:33:43 +02:00 · 2026-04-25 15:44:01 +02:00 · 2026-04-25 15:35:32 +02:00
6 changed files with 88 additions and 60 deletions
--- a/README.md
+++ b/README.md
@@ -7,23 +7,29 @@ One-line installer for the [Cameleer](https://cameleer.io) observability platfor
 **Linux / macOS:**

 ```bash
-curl -fsSL https://registry.cameleer.io/cameleer/cameleer-saas-installer/raw/branch/main/get-cameleer.sh | bash
-cd installer && ./install.sh
+bash -c "$(curl -fsSL https://registry.cameleer.io/cameleer/cameleer-saas-installer/raw/branch/main/get-cameleer.sh)"
 ```

 **Windows (PowerShell):**

 ```powershell
 irm https://registry.cameleer.io/cameleer/cameleer-saas-installer/raw/branch/main/get-cameleer.ps1 | iex
-cd installer; .\install.sh
 ```

+The bootstrap downloads the installer into `./installer/` and launches it immediately. The interactive prompts run in your terminal.
+
 **Pin a version:**

 ```bash
-curl -fsSL .../get-cameleer.sh | bash -s -- --version=v1.0.0
+bash -c "$(curl -fsSL .../get-cameleer.sh)" -- --version=v1.0.0
 ```

+```powershell
+& ([scriptblock]::Create((irm .../get-cameleer.ps1))) -Version v1.0.0
+```
+
+Any extra arguments are forwarded to `install.sh` / `install.ps1` (e.g. `--silent`, `--expert`, `--public-host=…`).
+
 ## Deployment Modes

 | | Multi-tenant SaaS | Standalone |
@@ -216,9 +222,10 @@ All services share a single hostname. Routing:

 | File | Purpose |
 |------|---------|
-| `get-cameleer.sh` | Bootstrap script (bash) — downloads installer files |
-| `get-cameleer.ps1` | Bootstrap script (PowerShell) — downloads installer files |
-| `install.sh` | Main installer — interactive or silent deployment |
+| `get-cameleer.sh` | Bootstrap script (bash) — downloads installer files and launches `install.sh` |
+| `get-cameleer.ps1` | Bootstrap script (PowerShell) — downloads installer files and launches `install.ps1` |
+| `install.sh` | Main installer (Linux / macOS) — interactive or silent deployment |
+| `install.ps1` | Main installer (Windows PowerShell) — interactive or silent deployment |
 | `templates/docker-compose.yml` | Base infrastructure (Traefik, PostgreSQL, ClickHouse) |
 | `templates/docker-compose.saas.yml` | SaaS mode (Logto + management plane) |
 | `templates/docker-compose.server.yml` | Standalone mode (server + UI) |
--- a/get-cameleer.ps1
+++ b/get-cameleer.ps1
@@ -4,12 +4,13 @@
  Bootstrap script — downloads the Cameleer installer and runs it.
 .EXAMPLE
  irm https://registry.cameleer.io/cameleer/cameleer-saas-installer/raw/branch/main/get-cameleer.ps1 | iex
-  .\get-cameleer.ps1 -Version v1.2.0
+  & ([scriptblock]::Create((irm https://.../get-cameleer.ps1))) -Version v1.2.0
 #>
 param(
    [string]$Version,
    [string]$Ref,
-    [switch]$Run
+    [Parameter(ValueFromRemainingArguments = $true)]
+    [string[]]$InstallerArgs
 )

 $ErrorActionPreference = 'Stop'
@@ -23,7 +24,7 @@ $Base = "$Repo/$RefPath"
 $Dir  = '.\installer'

 $Files = @(
-    'install.sh'
+    'install.ps1'
    'templates/docker-compose.yml'
    'templates/docker-compose.saas.yml'
    'templates/docker-compose.server.yml'
@@ -47,11 +48,12 @@ foreach ($file in $Files) {
 }

 Write-Host ''
-Write-Host "Installer ready in $Dir\"
-Write-Host 'Run:  cd installer; .\install.sh'
+Write-Host "Installer downloaded to $Dir\ — launching..."
 Write-Host ''

-if ($Run) {
-    Set-Location $Dir
-    & .\install.sh @args
+$installerPath = Join-Path $Dir 'install.ps1'
+if ($InstallerArgs) {
+    & $installerPath @InstallerArgs
+} else {
+    & $installerPath
 }
--- a/get-cameleer.sh
+++ b/get-cameleer.sh
@@ -3,18 +3,20 @@ set -euo pipefail

 # Bootstrap script — downloads the Cameleer installer and runs it.
 # Usage:
-#   curl -fsSL https://get.cameleer.io/install | bash
-#   curl -fsSL https://get.cameleer.io/install | bash -s -- --version v1.2.0
+#   bash -c "$(curl -fsSL https://get.cameleer.io/install)"
+#   bash -c "$(curl -fsSL https://get.cameleer.io/install)" -- --version v1.2.0

 REPO="https://registry.cameleer.io/cameleer/cameleer-saas-installer/raw"
 REF="branch/main"
 DIR="./installer"

-# Parse --version / --ref
+# Parse --version / --ref (consume them; remaining args are forwarded to install.sh)
+PASS_ARGS=()
 for arg in "$@"; do
  case "$arg" in
-    --version=*) REF="tag/${arg#*=}"; shift ;;
-    --ref=*)     REF="branch/${arg#*=}"; shift ;;
+    --version=*) REF="tag/${arg#*=}" ;;
+    --ref=*)     REF="branch/${arg#*=}" ;;
+    *)           PASS_ARGS+=("$arg") ;;
  esac
 done

@@ -43,13 +45,8 @@ done
 chmod +x "$DIR/install.sh"

 echo ""
-echo "Installer ready in $DIR/"
-echo "Run:  cd $DIR && ./install.sh"
+echo "Installer downloaded to $DIR/ — launching..."
 echo ""

-# Auto-run if not piped with extra args that look like they want manual control
-if [ "${1:-}" = "--run" ]; then
-  shift
-  cd "$DIR"
-  exec ./install.sh "$@"
-fi
+cd "$DIR"
+exec ./install.sh "${PASS_ARGS[@]}"
--- a/install.ps1
+++ b/install.ps1
@@ -255,7 +255,14 @@ function Write-Utf8File {
    $enc = New-Object System.Text.UTF8Encoding $false
    [System.IO.File]::WriteAllText($Path, $Content, $enc)
 }
- 
+
+# Single-quote a value for .env/.conf files so special characters ($, &, ;, etc.)
+# are preserved. Embedded single quotes are escaped as '\''.
+function Format-EnvVal([string]$Key, [string]$Val) {
+    $escaped = $Val -replace "'", "'\\''"
+    return "$Key='$escaped'"
+}
+
 # --- Config file ---
 
 function Load-ConfigFile {
@@ -266,6 +273,12 @@ function Load-ConfigFile {
        if ($line -match '^\s*([^=]+?)\s*=\s*(.*?)\s*$') {
            $key = $Matches[1].Trim()
            $val = $Matches[2].Trim()
+            # Strip surrounding quotes and unescape '\''
+            if ($val.Length -ge 2 -and $val[0] -eq "'" -and $val[-1] -eq "'") {
+                $val = $val.Substring(1, $val.Length - 2) -replace "'\\''"  , "'"
+            } elseif ($val.Length -ge 2 -and $val[0] -eq '"' -and $val[-1] -eq '"') {
+                $val = $val.Substring(1, $val.Length - 2)
+            }
            switch ($key) {
                'install_dir'           { if (-not $script:cfg.InstallDir)          { $script:cfg.InstallDir          = $val } }
                'public_host'           { if (-not $script:cfg.PublicHost)           { $script:cfg.PublicHost           = $val } }
@@ -669,15 +682,10 @@ HTTPS_PORT=$($c.HttpsPort)

 # PostgreSQL
 POSTGRES_USER=cameleer
-POSTGRES_PASSWORD=$($c.PostgresPassword)
 POSTGRES_DB=cameleer

-# ClickHouse
-CLICKHOUSE_PASSWORD=$($c.ClickhousePassword)
-
 # Server admin
 SERVER_ADMIN_USER=$($c.AdminUser)
-SERVER_ADMIN_PASS=$($c.AdminPass)

 # Bootstrap token
 BOOTSTRAP_TOKEN=$bt
@@ -697,6 +705,10 @@ CLICKHOUSE_IMAGE=$($c.Registry)/cameleer-clickhouse
 SERVER_IMAGE=$($c.Registry)/cameleer-server
 SERVER_UI_IMAGE=$($c.Registry)/cameleer-server-ui
 "@
+        # Passwords appended with single-quoting for special character safety
+        $content += "`n$(Format-EnvVal 'POSTGRES_PASSWORD' $c.PostgresPassword)"
+        $content += "`n$(Format-EnvVal 'CLICKHOUSE_PASSWORD' $c.ClickhousePassword)"
+        $content += "`n$(Format-EnvVal 'SERVER_ADMIN_PASS' $c.AdminPass)"
        if ($c.TlsMode -eq 'custom') {
            $content += "`nCERT_FILE=/user-certs/cert.pem"
            $content += "`nKEY_FILE=/user-certs/key.pem"
@@ -728,16 +740,11 @@ LOGTO_CONSOLE_BIND=$consoleBind

 # PostgreSQL
 POSTGRES_USER=cameleer
-POSTGRES_PASSWORD=$($c.PostgresPassword)
 POSTGRES_DB=cameleer_saas
- 
-# ClickHouse
-CLICKHOUSE_PASSWORD=$($c.ClickhousePassword)
- 
+
 # Admin user
 SAAS_ADMIN_USER=$($c.AdminUser)
-SAAS_ADMIN_PASS=$($c.AdminPass)
- 
+
 # TLS
 NODE_TLS_REJECT=$($c.NodeTlsReject)
 "@
@@ -772,10 +779,14 @@ CAMELEER_SERVER_SECURITY_JWTSECRET=$jwtSecret
 SMTP_HOST=$($c.SmtpHost)
 SMTP_PORT=$(if ($c.SmtpPort) { $c.SmtpPort } else { '587' })
 SMTP_USER=$($c.SmtpUser)
-SMTP_PASS=$($c.SmtpPass)
 SMTP_FROM_EMAIL=$(if ($c.SmtpFromEmail) { $c.SmtpFromEmail } else { "noreply@$($c.PublicHost)" })
 "@
        $content += $provisioningBlock
+        # Passwords appended with single-quoting for special character safety
+        $content += "`n$(Format-EnvVal 'POSTGRES_PASSWORD' $c.PostgresPassword)"
+        $content += "`n$(Format-EnvVal 'CLICKHOUSE_PASSWORD' $c.ClickhousePassword)"
+        $content += "`n$(Format-EnvVal 'SAAS_ADMIN_PASS' $c.AdminPass)"
+        $content += "`n$(Format-EnvVal 'SMTP_PASS' $c.SmtpPass)"
        $composeFile = 'docker-compose.yml;docker-compose.saas.yml'
        if ($c.TlsMode -eq 'custom') { $composeFile += ';docker-compose.tls.yml' }
        if ($c.MonitoringNetwork)     { $composeFile += ';docker-compose.monitoring.yml' }
@@ -1017,12 +1028,13 @@ deployment_mode=$($c.DeploymentMode)
 smtp_host=$($c.SmtpHost)
 smtp_port=$($c.SmtpPort)
 smtp_user=$($c.SmtpUser)
-smtp_pass=$($c.SmtpPass)
 smtp_from_email=$($c.SmtpFromEmail)
 registry=$($c.Registry)
 registry_user=$($c.RegistryUser)
-registry_token=$($c.RegistryToken)
 "@
+    # Passwords appended with single-quoting for special character safety
+    $txt += "`n$(Format-EnvVal 'smtp_pass' $c.SmtpPass)"
+    $txt += "`n$(Format-EnvVal 'registry_token' $c.RegistryToken)"
    Write-Utf8File $f $txt
    Log-Info 'Saved installer config to cameleer.conf'
 }
--- a/install.sh
+++ b/install.sh
@@ -156,6 +156,14 @@ generate_password() {
  tr -dc 'A-Za-z0-9' < /dev/urandom | head -c 32 || :
 }

+# Write KEY='escaped_value' to a file. Single-quotes prevent Docker Compose
+# from interpreting $, &, ;, etc. Embedded single quotes are escaped as '\''.
+env_val() {
+  local file="$1" key="$2" val="$3"
+  val="${val//\'/\'\\\'\'}"
+  printf "%s='%s'\n" "$key" "$val" >> "$file"
+}
+
 # --- Argument parsing ---

 parse_args() {
@@ -259,8 +267,9 @@ load_config_file() {
    case "$key" in
      \#*|"") continue ;;
    esac
-    key=$(echo "$key" | tr -d ' ')
-    value=$(echo "$value" | sed 's/^[ ]*//;s/[ ]*$//')
+    key=$(printf '%s' "$key" | tr -d ' ')
+    # Trim whitespace, strip surrounding quotes, unescape '\''
+    value=$(printf '%s' "$value" | sed "s/^[ ]*//;s/[ ]*$//;s/^'\\(.*\\)'$/\\1/;s/^\"\\(.*\\)\"$/\\1/" | sed "s/'\\\\''/'/g")
    case "$key" in
      install_dir)          [ -z "$INSTALL_DIR" ] && INSTALL_DIR="$value" ;;
      public_host)          [ -z "$PUBLIC_HOST" ] && PUBLIC_HOST="$value" ;;
@@ -663,15 +672,10 @@ HTTPS_PORT=${HTTPS_PORT}

 # PostgreSQL
 POSTGRES_USER=cameleer
-POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
 POSTGRES_DB=cameleer

-# ClickHouse
-CLICKHOUSE_PASSWORD=${CLICKHOUSE_PASSWORD}
-
 # Server admin
 SERVER_ADMIN_USER=${ADMIN_USER}
-SERVER_ADMIN_PASS=${ADMIN_PASS}

 # Bootstrap token (required by server, not used externally in standalone mode)
 BOOTSTRAP_TOKEN=$(generate_password)
@@ -694,6 +698,10 @@ SERVER_UI_IMAGE=${REGISTRY}/cameleer-server-ui
 # Compose file assembly
 COMPOSE_FILE=docker-compose.yml:docker-compose.server.yml$([ "$TLS_MODE" = "custom" ] && echo ":docker-compose.tls.yml")$([ -n "$MONITORING_NETWORK" ] && echo ":docker-compose.monitoring.yml")
 EOF
+    # Passwords are appended with single-quoting to handle special characters
+    env_val "$f" POSTGRES_PASSWORD "$POSTGRES_PASSWORD"
+    env_val "$f" CLICKHOUSE_PASSWORD "$CLICKHOUSE_PASSWORD"
+    env_val "$f" SERVER_ADMIN_PASS "$ADMIN_PASS"
    if [ "$TLS_MODE" = "custom" ]; then
      echo "CERT_FILE=/user-certs/cert.pem" >> "$f"
      echo "KEY_FILE=/user-certs/key.pem" >> "$f"
@@ -729,15 +737,10 @@ LOGTO_CONSOLE_BIND=$([ "$LOGTO_CONSOLE_EXPOSED" = "true" ] && echo "0.0.0.0" ||

 # PostgreSQL
 POSTGRES_USER=cameleer
-POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
 POSTGRES_DB=cameleer_saas

-# ClickHouse
-CLICKHOUSE_PASSWORD=${CLICKHOUSE_PASSWORD}
-
 # Admin user
 SAAS_ADMIN_USER=${ADMIN_USER}
-SAAS_ADMIN_PASS=${ADMIN_PASS}

 # TLS
 NODE_TLS_REJECT=${NODE_TLS_REJECT}
@@ -778,13 +781,18 @@ CAMELEER_SERVER_SECURITY_JWTSECRET=$(generate_password)
 SMTP_HOST=${SMTP_HOST}
 SMTP_PORT=${SMTP_PORT:-587}
 SMTP_USER=${SMTP_USER}
-SMTP_PASS=${SMTP_PASS}
 SMTP_FROM_EMAIL=${SMTP_FROM_EMAIL:-noreply@${PUBLIC_HOST}}

 # Compose file assembly
 COMPOSE_FILE=docker-compose.yml:docker-compose.saas.yml$([ "$TLS_MODE" = "custom" ] && echo ":docker-compose.tls.yml")$([ -n "$MONITORING_NETWORK" ] && echo ":docker-compose.monitoring.yml")
 EOF

+  # Passwords are appended with single-quoting to handle special characters
+  env_val "$f" POSTGRES_PASSWORD "$POSTGRES_PASSWORD"
+  env_val "$f" CLICKHOUSE_PASSWORD "$CLICKHOUSE_PASSWORD"
+  env_val "$f" SAAS_ADMIN_PASS "$ADMIN_PASS"
+  env_val "$f" SMTP_PASS "$SMTP_PASS"
+
  if [ -n "$MONITORING_NETWORK" ]; then
    echo "" >> "$f"
    echo "# Monitoring" >> "$f"
@@ -967,12 +975,13 @@ deployment_mode=${DEPLOYMENT_MODE}
 smtp_host=${SMTP_HOST}
 smtp_port=${SMTP_PORT}
 smtp_user=${SMTP_USER}
-smtp_pass=${SMTP_PASS}
 smtp_from_email=${SMTP_FROM_EMAIL}
 registry=${REGISTRY}
 registry_user=${REGISTRY_USER}
-registry_token=${REGISTRY_TOKEN}
 EOF
+  # Passwords appended with single-quoting for special character safety
+  env_val "$f" smtp_pass "$SMTP_PASS"
+  env_val "$f" registry_token "$REGISTRY_TOKEN"
  log_info "Saved installer config to cameleer.conf"
 }

--- a/templates/docker-compose.saas.yml
+++ b/templates/docker-compose.saas.yml
@@ -9,7 +9,8 @@ services:
      cameleer-postgres:
        condition: service_healthy
    environment:
-      DB_URL: postgres://${POSTGRES_USER:-cameleer}:${POSTGRES_PASSWORD}@cameleer-postgres:5432/logto
+      # DB_URL is built by the entrypoint from PG_USER/PG_PASSWORD/PG_HOST
+      # to safely handle special characters in the password
      ENDPOINT: ${PUBLIC_PROTOCOL:-https}://${AUTH_HOST:-localhost}
      ADMIN_ENDPOINT: ${PUBLIC_PROTOCOL:-https}://${AUTH_HOST:-localhost}:${LOGTO_CONSOLE_PORT:-3002}
      TRUST_PROXY_HEADER: 1