wger: persist generated SECRET_KEY and JWT keys; default DJANGO_DEBUG in env_vars

Generate SECRET_KEY and the JWT keypair once into /data/secrets.env and merge
them into /data/env.sh before the env_vars file, so user values still win.
Without JWT keys the mobile app login fails with a 500 (#3123).
Also set DJANGO_DEBUG=False in the default env_vars option.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

wger/CHANGELOG.md

@@ -1,6 +1,8 @@
 ## 2.8.0-dev.1.1 (2026-10-16)
 
 - Fix blank dashboard and non-working menus caused by 404s on frontend assets (bootstrap, htmx, fontawesome, react components). Upstream's entrypoint only collects static files when `DJANGO_DEBUG` is explicitly `False`, which the add-on never set; it is now set in the image (#3123).
+- Set `DJANGO_DEBUG=False` in the default `env_vars` option for new installs; the image keeps it as a fallback for existing installs, whose options are not updated.
+- Generate `SECRET_KEY`, `JWT_PRIVATE_KEY` and `JWT_PUBLIC_KEY` on first start and store them in `/data/secrets.env`. This fixes the wger mobile app login failing with a 500 error, and keeps web sessions across restarts. Values set through `env_vars` still take precedence.
 
 ## 2.8.0-dev.1 (2026-10-10)
 - Update to latest version from wger/server

wger/config.yaml

@@ -10,7 +10,9 @@ map:
   - ssl:ro
 name: Wger
 options:
-  env_vars: []
+  env_vars:
+    - name: DJANGO_DEBUG
+      value: "False"
   CONFIG_LOCATION: /config/config.yaml
 ports:
   80/tcp: 9927

wger/rootfs/etc/cont-init.d/90-run.sh

@@ -68,21 +68,33 @@ prepare_writable_dir /data/static
 prepare_writable_dir /data/media
 migrate_database
 
+echo "... generate persistent secrets"
+# Without JWT keys the mobile app login fails with a 500, and without SECRET_KEY
+# sessions are lost at every restart. Generated once, env_vars still override them.
+if ! grep -qs '^JWT_PRIVATE_KEY=' /data/secrets.env; then
+    {
+        echo "SECRET_KEY=$(python3 -c 'import secrets; print(secrets.token_urlsafe(50))')"
+        (cd /home/wger/src && sudo -u wger -E HOME=/home/wger python3 manage.py generate-jwt-keys 2> /dev/null | grep '^JWT_')
+    } > /data/secrets.env || bashio::log.warning "Unable to generate JWT keys"
+    chmod 600 /data/secrets.env
+fi
+
 echo "... add env variables"
 (
     set -o posix
     export -p
 ) > /data/env.sh
 
-if [ -f /.env ]; then
+for envfile in /data/secrets.env /.env; do
+    [ -f "$envfile" ] || continue
     while IFS= read -r line; do
         [[ -z "$line" || "$line" =~ ^[[:space:]]*# ]] && continue
         var="${line%%=*}"
         [[ "$var" =~ ^[A-Za-z_][A-Za-z0-9_]*$ ]] || continue
         sed -i "/^export[[:space:]]\+$var=/d" /data/env.sh
         echo "export $line" >> /data/env.sh
-    done < /.env
-fi
+    done < "$envfile"
+done
 
 chown wger /data/env.sh || bashio::log.warning "Unable to set /data/env.sh ownership to wger"
 chmod 0644 /data/env.sh || bashio::log.warning "Unable to make /data/env.sh readable"