From 63ed42ca3d9d7842db6480c8f4c108ceb10eb489 Mon Sep 17 00:00:00 2001
From: Miguel Serrano <mserranom@users.noreply.github.com>
Date: Fri, 5 Jun 2026 14:22:32 +0200
Subject: [PATCH] [CE/SP] Add init script to check for missing secrets (#34345)

* [CE/SP] Add init script to check missing secrets

* Added OVERLEAF_INVITE_TOKEN_SECRET to CE compose files

GitOrigin-RevId: 1bc15763edfc43782038bdfd173067230477ce94
---
 docker-compose.yml                            |  3 +
 .../init_scripts/000_check_missing_secrets.sh | 59 +++++++++++++++++++
 server-ce/test/docker-compose.yml             |  1 +
 3 files changed, 63 insertions(+)
 create mode 100755 server-ce/init_scripts/000_check_missing_secrets.sh

diff --git a/docker-compose.yml b/docker-compose.yml
index fc2c01fa71..5d50667085 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -30,6 +30,9 @@ services:
       OVERLEAF_REDIS_HOST: redis
       REDIS_HOST: redis
 
+      # IMPORTANT: Required for invite token generation
+      # OVERLEAF_INVITE_TOKEN_SECRET: generate with `openssl rand -base64 32`
+
       ENABLED_LINKED_FILE_TYPES: "project_file,project_output_file"
 
       # Enables Thumbnail generation using ImageMagick
diff --git a/server-ce/init_scripts/000_check_missing_secrets.sh b/server-ce/init_scripts/000_check_missing_secrets.sh
new file mode 100755
index 0000000000..036cb556e7
--- /dev/null
+++ b/server-ce/init_scripts/000_check_missing_secrets.sh
@@ -0,0 +1,59 @@
+#!/bin/bash
+
+set -e
+
+REQUIRED_SECRETS="
+OVERLEAF_INVITE_TOKEN_SECRET
+"
+
+MISSING_ITEMS=""
+for name in ${REQUIRED_SECRETS}; do
+  if [[ -z "${!name}" ]]; then
+    MISSING_ITEMS="$MISSING_ITEMS $name"
+  fi
+done
+
+if [[ "$MISSING_ITEMS" == "" ]]; then
+  exit 0
+fi
+
+MISSING_ITEMS=$(echo "$MISSING_ITEMS" | xargs -n1 | sed 's/^/      - /')
+N=$(echo "$MISSING_ITEMS" | wc -l)
+cat <<EOF
+------------------------------------------------------------------------
+
+                     Missing required secrets
+                     ------------------------
+
+  Your configuration is missing $N required secret(s):
+$MISSING_ITEMS
+
+  These secrets must be set to persistent random values and kept
+   stable across container restarts and upgrades. Regenerating them
+   will invalidate previously issued tokens stored in the database.
+
+  Generate a value with, for example:
+
+    openssl rand -base64 32
+
+
+  Overleaf toolkit setups:
+
+    Add the missing variable(s) to config/variables.env and restart:
+
+      github.com/overleaf/toolkit$ bin/up
+
+
+  docker compose setups:
+
+    Add the missing variable(s) to the sharelatex service environment
+     in docker-compose.yml (or your override file) and restart.
+
+
+  Refusing to startup, exiting in 10s.
+
+------------------------------------------------------------------------
+EOF
+
+sleep 10
+exit 101
diff --git a/server-ce/test/docker-compose.yml b/server-ce/test/docker-compose.yml
index 056b7c73de..26da756b2b 100644
--- a/server-ce/test/docker-compose.yml
+++ b/server-ce/test/docker-compose.yml
@@ -22,6 +22,7 @@ services:
       ENABLED_LINKED_FILE_TYPES: "project_file,project_output_file"
       ENABLE_CONVERSIONS: "true"
       EMAIL_CONFIRMATION_DISABLED: "true"
+      OVERLEAF_INVITE_TOKEN_SECRET: "invite-token-secret"
     healthcheck:
       test: curl --fail http://localhost:3000/status
       interval: 3s