Avoid persisting bootstrap admin credentials in config.php and manager env

[stoertebeker]

Summary

The bootstrap flow persists the initial admin password into config.php and also passes NC_admin_password into the long-lived manager container, even though that container does not need it.

Evidence

• configs/installer/nextcloud_config_default.php:33-53 copies NC_admin_password into $CONFIG.
• configs/installer/nextcloud_config_default.php:81-86 rewrites config.php with that value.
• compose.yaml:149-150 passes NC_admin_password to installer.
• compose.yaml:269-270 passes NC_admin_password to manager.

Risk

A one-time bootstrap secret becomes a standing credential on disk and in container metadata. That increases the impact of host access, volume disclosure, backups, or container inspection.

Suggested Remediation

• Do not persist admin_password into config.php after installation.
• Remove NC_admin_password from the manager service environment.
• Prefer a one-time bootstrap secret flow or secret mount instead of a long-lived environment variable.

Related

• Related to Make secrets secret #9
• Related to Nextcloud: occ maintenance:install writes wrong config into the config.php file #12