feat(scripts): fold generate-secrets.sh into update.sh, auto-mint virtual keys

update.sh now creates .env from .env.example if missing, idempotently fills
in every random secret (same logic generate-secrets.sh had, now removed),
resolves SEARXNG_LAN_IP from search.home via the host's own DNS, and mints
OPENWEBUI_LITELLM_KEY / MEMORY_RETRIEVAL_EMBEDDING_KEY through LiteLLM's own
/key/generate API once litellm is up — no more manual Admin UI step for the
stack's own two workload keys. Docs updated to point at update.sh as the
one command; docs/proxy-key-onboarding.md keeps the manual/API steps as the
fallback and for onboarding other workloads.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

scripts/update.sh

@@ -1,8 +1,9 @@
 #!/usr/bin/env bash
 # The one command to run after any change to this repo (compose file,
 # litellm-config.yaml, .env, or a git pull) to bring the running stack in
-# sync. Pulls, validates, rebuilds/re-pulls images, and recreates only what
-# changed — safe to run any time, including with nothing to do.
+# sync. Ensures secrets/keys exist, pulls, validates, rebuilds/re-pulls
+# images, and recreates only what changed — safe to run any time, including
+# with nothing to do.
 #
 # ponytail: no rollback/backup logic — this is a single-user homelab box,
 # not a fleet. If a bad config lands, `git revert` + re-run is the recovery
@@ -10,6 +11,39 @@
 set -euo pipefail
 cd "$(dirname "$0")/.."
 
+[ -f .env ] || cp .env.example .env
+
+set_if_blank() {
+  local key="$1" value="$2"
+  if grep -qE "^${key}=.*[^[:space:]]" .env; then
+    echo "${key}: already set, skipping."
+  else
+    sed -i "s|^${key}=.*|${key}=${value}|" .env
+    echo "${key}: set."
+  fi
+}
+
+echo "==> filling in missing secrets"
+# Random values — safe to re-run, never overwrites what's already set.
+# LITELLM_SALT_KEY especially: never change it after first run, existing
+# encrypted data becomes unreadable if you do.
+set_if_blank LITELLM_MASTER_KEY "$(openssl rand -hex 32)"
+set_if_blank LITELLM_SALT_KEY "$(openssl rand -hex 32)"
+set_if_blank LITELLM_DB_PASSWORD "$(openssl rand -hex 32)"
+set_if_blank UI_PASSWORD "$(openssl rand -hex 16)"
+set_if_blank PGVECTOR_DB_PASSWORD "$(openssl rand -hex 32)"
+set_if_blank MEMORY_RETRIEVAL_API_KEY "$(openssl rand -hex 32)"
+
+echo "==> resolving SEARXNG_LAN_IP"
+# search.home is a LAN mDNS/local-DNS name — resolvable from this host, just
+# not from inside the litellm container (see docs/research/litellm-searxng-search.md).
+searxng_ip="$(getent hosts search.home 2>/dev/null | awk '{print $1}' | head -1)"
+if [ -n "$searxng_ip" ]; then
+  set_if_blank SEARXNG_LAN_IP "$searxng_ip"
+else
+  echo "SEARXNG_LAN_IP: couldn't resolve search.home from this host, set it manually if still blank."
+fi
+
 echo "==> git pull"
 git pull --ff-only
 
@@ -19,9 +53,40 @@ docker compose config -q
 echo "==> pulling images"
 docker compose pull --ignore-buildable
 
-echo "==> rebuilding local-build services (e.g. litellm-pgvector)"
+echo "==> rebuilding local-build services"
 docker compose build --pull
 
+echo "==> bringing up litellm (needed to mint virtual keys below)"
+docker compose up -d --wait litellm-db litellm
+
+# OPENWEBUI_LITELLM_KEY / MEMORY_RETRIEVAL_EMBEDDING_KEY are per-workload
+# virtual keys, not random secrets — minted via LiteLLM's own API
+# (docs/proxy-key-onboarding.md documents the manual Admin UI route; this is
+# the same thing over the REST endpoint LITELLM_MASTER_KEY already
+# authenticates against).
+set -a && . ./.env && set +a
+mint_key_if_blank() {
+  local key="$1" alias="$2"
+  if grep -qE "^${key}=.*[^[:space:]]" .env; then
+    echo "${key}: already set, skipping."
+    return
+  fi
+  local minted
+  minted=$(curl -sf -X POST "http://localhost:${LITELLM_PORT:-4000}/key/generate" \
+    -H "Authorization: Bearer ${LITELLM_MASTER_KEY}" \
+    -H "Content-Type: application/json" \
+    -d "{\"key_alias\": \"${alias}\"}" | jq -r '.key')
+  if [ -n "$minted" ] && [ "$minted" != "null" ]; then
+    sed -i "s|^${key}=.*|${key}=${minted}|" .env
+    echo "${key}: minted."
+  else
+    echo "${key}: mint failed, create it by hand per docs/proxy-key-onboarding.md."
+  fi
+}
+mint_key_if_blank OPENWEBUI_LITELLM_KEY openwebui
+mint_key_if_blank MEMORY_RETRIEVAL_EMBEDDING_KEY memory-retrieval
+set -a && . ./.env && set +a
+
 echo "==> recreating changed services"
 docker compose up -d --remove-orphans