officer-setup: the environment section

Writes .env, and the whole point of the section is the two values it must not
write twice.

JWT_SECRET and VAULT_STORE_KEY are read back from any existing .env and kept.
The original script reminted JWT_SECRET on every run that agreed to regenerate
.env, which logs every device out with no stated reason, and never wrote
VAULT_STORE_KEY at all — so a scripted install had no at-rest key and the vault
and wallet refused to store anything.

VAULT_STORE_KEY is the more dangerous of the two now that it is being written.
It is not Vaultwarden's despite the name: it encrypts every secret column in
Postgres, and the wallet seed envelope on top of the owner passphrase. Changing
it is unrecoverable for the seed, because the passphrase opens the inner
envelope and that is the outer one. Said in the section, in the file it writes,
and in .env.example, which described it as Vaultwarden's and understated it.

DATA_PATH and OFFICER_ITEMS_DIR are derived from $OFFICER_ROOT rather than
asked — two questions that had to agree with each other and with the app store.

ALLOW_ANY_ORIGIN is written explicitly from whether tailscale0 exists, rather
than left to the platform default. The default is ON, which CLAUDE.md says is
only defensible because the tailnet is the perimeter; with no tailnet there is
no perimeter, so it goes out as false. Added to .env.example, which omitted it.

PORT defaults to 9000, matching .env.example. The old script used 9010; nothing
depends on either, and it is a prompt.

write_env restores the prior umask. It was set to 077 so the secrets are never
briefly world-readable, but umask is not scoped to a function and would have
made every file the later sections create owner-only.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

scripts/setup/officer-setup/lib/env.sh

@@ -0,0 +1,123 @@
+#!/bin/bash
+# =============================================================================
+# officer-setup — the environment file
+# =============================================================================
+#
+# Definitions only.
+#
+# ── Two secrets that must never be regenerated ──
+#
+# JWT_SECRET signs every session token. Minting a new one logs everybody out of
+# every device, silently — the symptom is people being signed out for no stated
+# reason. The original regenerated it on every run that answered "yes" to
+# regenerating .env.
+#
+# VAULT_STORE_KEY is worse, and the original never wrote it at all — so a
+# scripted install had no key and the vault and wallet refused to store anything.
+# It encrypts every upstream credential the platform holds (see docs/secret-store.md
+# for the full list) and, on top of the owner passphrase, the BIP39 seed envelope.
+# Changing it makes all of them unreadable, and for the seed that is unrecoverable:
+# the passphrase opens the inner envelope, and the outer one is gone. Unless the
+# mnemonic was written down offline, so are the coins.
+#
+# Both are read back from an existing .env and kept. Both are slated to move into
+# the secret store — docs/secret-store.md — which is what makes changing them an
+# operation rather than data loss.
+#
+# ── Derived, not asked ──
+#
+# DATA_PATH and OFFICER_ITEMS_DIR come from $OFFICER_ROOT. They were two separate
+# questions in the original, which had to agree with each other and with where the
+# app store looks.
+
+[[ -n "${OFFICER_SETUP_ENV_LOADED:-}" ]] && return 0
+OFFICER_SETUP_ENV_LOADED=1
+
+env_file() { echo "$(platform_dir)/.env"; }
+
+env_exists() { [[ -f "$(env_file)" ]]; }
+
+# One value out of an existing .env, without sourcing it — the file holds
+# secrets and arbitrary shell would run as root.
+env_get() {
+  [[ -r "$(env_file)" ]] || return 0
+  awk -F= -v k="$1" '
+    $1 == k {
+      v = substr($0, index($0, "=") + 1)
+      gsub(/^"|"$/, "", v)
+      print v
+      exit
+    }' "$(env_file)"
+}
+
+# Long enough to be worth having, and stripped of characters that would need
+# quoting in a file everything reads with a naive parser.
+generate_secret() { openssl rand -base64 48 | tr -d '/+=\n' | head -c 48; }
+
+# Origin checking is OFF unless this is explicitly false — CLAUDE.md is explicit
+# that the inversion is deliberate and is only defensible because the tailnet is
+# the perimeter. With no tailnet there is no perimeter, so the default stops
+# being defensible and the value has to be written the other way.
+tailnet_present() { ip link show tailscale0 &>/dev/null; }
+
+write_env() {
+  local dest
+  dest="$(env_file)"
+
+  [[ -f "$dest" ]] && cp -a "$dest" "${dest}.before-officer-setup"
+
+  # Restrictive from the moment it exists rather than chmod'd afterwards, so the
+  # secrets are never briefly world-readable. Restored straight after: umask is
+  # not scoped to a function, and leaving it at 077 would quietly make every file
+  # a later section creates owner-only.
+  local prior_umask
+  prior_umask="$(umask)"
+  umask 077
+  cat >"$dest" <<ENVF
+# Written by officer-setup.
+#
+# Everything Officer reads at runtime. Kept at 0600 and owned by ${USERNAME}: it
+# holds the token-signing secret and the database credential.
+
+PORT="${ENV_PORT}"
+PUBLIC_URL="${ENV_PUBLIC_URL}"
+PUBLIC_BUILD_ENV="production"
+
+# The browser relay listens on its own port, separate from the app.
+BROWSER_RELAY_PORT="${ENV_BROWSER_RELAY_PORT}"
+
+# ── Do not regenerate either of these ──
+#
+# JWT_SECRET signs every session token. A new one logs everybody out, everywhere.
+JWT_SECRET="${ENV_JWT_SECRET}"
+
+# VAULT_STORE_KEY encrypts every upstream credential in Postgres, and encrypts
+# the wallet's seed envelope on top of the owner passphrase. Changing it makes
+# all of them unreadable — and for the seed that is unrecoverable, passphrase or
+# not. Back it up with the same seriousness as the mnemonics.
+VAULT_STORE_KEY="${ENV_VAULT_STORE_KEY}"
+
+POSTGRES_URL="${POSTGRES_URL}"
+
+# Derived from the install root — see scripts/setup/officer-setup/lib/layout.sh.
+DATA_PATH="${OFFICER_ROOT}/data"
+OFFICER_ITEMS_DIR="${OFFICER_ROOT}/capabilities"
+
+# The owner's real login home, which is where terminals, chats and task runs
+# actually execute — as opposed to the managed home under DATA_PATH.
+HOME_DIR="${USER_HOME}"
+
+# Origin checking. Off by default in the platform, which is only safe behind a
+# tailnet; written explicitly here so the machine's actual situation decides it.
+ALLOW_ANY_ORIGIN="${ENV_ALLOW_ANY_ORIGIN}"
+
+MAIL_TRANSPORT="${ENV_MAIL_TRANSPORT}"
+DISCORD_BUG_REPORT_WEBHOOK="${ENV_DISCORD_WEBHOOK}"
+ENVF
+
+  umask "$prior_umask"
+
+  chown "${USERNAME}:$(user_group)" "$dest"
+  chmod 600 "$dest"
+  return 0
+}