Fix three crash-looping services: koha-db, homebox, vaultwarden

koha-db: compose used MYSQL_ROOT_PASSWORD/MYSQL_DATABASE/MYSQL_USER/
MYSQL_PASSWORD, but this mariadb:11 image version's entrypoint doesn't
recognize MYSQL_ROOT_PASSWORD as any of its accepted root-password
options at all. Confirmed live: "Database is uninitialized and password
option is not specified" on every start, even though DB_ROOT_PASS was
correctly generated and present in .env the whole time. Switched all
four to their MARIADB_* equivalents.

homebox: a newer homebox release requires HBOX_AUTH_API_KEY_PEPPER (at
least 32 bytes) or the container panics on startup — this installer
never set it. Generate one with generate_password 48 and wire it
through .env + the compose environment block.

vaultwarden: the SMTP setup prompts let you enter a host but leave
"SMTP from address" blank (no default), writing a half-configured state
Vaultwarden refuses to start with ("Both SMTP_HOST and SMTP_FROM need
to be set"). Validate after prompting — if SMTP_HOST is set but
SMTP_FROM came back empty, disable SMTP entirely instead of writing a
config known to crash the container.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H4k6J1qXXyYxhGEgnJaMvn

services/homebox.sh

@@ -301,6 +301,16 @@ networks:
 "
     fi
 
+    # Required since a newer homebox release, not optional — confirmed
+    # live: without it the container panics on every start ("auth.
+    # api_key_pepper must be set to at least 32 bytes") and crash-loops.
+    # generate_password's default alphanumeric output is 1 byte/char, so
+    # 48 chars comfortably clears the 32-byte minimum. Rotating this later
+    # invalidates every issued API key, per homebox's own panic message —
+    # generated once here, never touched again on a rerun.
+    local HB_PEPPER
+    HB_PEPPER="$(generate_password 48)"
+
     cat > docker-compose.yml << HB_COMPOSE
 name: $CONTAINER
 
@@ -313,6 +323,7 @@ services:
     environment:
       - HBOX_LOG_LEVEL=info
       - HBOX_WEB_MAX_UPLOAD_SIZE=10
+      - HBOX_AUTH_API_KEY_PEPPER=\${HBOX_AUTH_API_KEY_PEPPER}
     volumes:
       - ./data:/data
     ports:
@@ -322,7 +333,11 @@ HB_COMPOSE
 
     cat > .env << HB_ENV
 CADDY_NET=$SITE_CADDY_NET
+
+# Rotating this invalidates every issued API key.
+HBOX_AUTH_API_KEY_PEPPER=$HB_PEPPER
 HB_ENV
+    chmod 600 .env
 
     chown -R "$ACTUAL_USER:$ACTUAL_USER" "$HB_DIR"
 

services/koha.sh

@@ -440,10 +440,16 @@ ${_CADDY_NET_ENTRY}
     hostname: koha-db
     restart: unless-stopped
     environment:
-      MYSQL_ROOT_PASSWORD: \${DB_ROOT_PASS}
-      MYSQL_DATABASE: koha_default
-      MYSQL_USER: koha_default
-      MYSQL_PASSWORD: \${DB_PASS}
+      # MARIADB_* not MYSQL_* — confirmed live, this image version's
+      # entrypoint doesn't recognize MYSQL_ROOT_PASSWORD as any of its
+      # accepted root-password options at all ("Database is uninitialized
+      # and password option is not specified"), so the container crash-
+      # loops even though DB_ROOT_PASS is correctly generated and present
+      # in .env the whole time. Switched all four for consistency.
+      MARIADB_ROOT_PASSWORD: \${DB_ROOT_PASS}
+      MARIADB_DATABASE: koha_default
+      MARIADB_USER: koha_default
+      MARIADB_PASSWORD: \${DB_PASS}
     volumes:
       - ./data:/var/lib/mysql
     networks:

services/vaultwarden.sh

@@ -324,6 +324,17 @@ install_vaultwarden() {
         prompt_text "SMTP from address:" "" SMTP_FROM
         prompt_text "SMTP username:" "" SMTP_USER
         prompt_text "SMTP password:" "" SMTP_PASS
+        # Vaultwarden refuses to start at all if SMTP_HOST is set without
+        # SMTP_FROM ("Both SMTP_HOST and SMTP_FROM need to be set") —
+        # confirmed live, crash-loops on every start, not just a warning at
+        # runtime. SMTP_FROM's own prompt has no default, so leaving it
+        # blank here writes exactly that broken half-state. Disable SMTP
+        # entirely rather than let it reach a config known to crash the
+        # container — better than guessing a from-address on your behalf.
+        if [ -z "$SMTP_FROM" ]; then
+            log_warning "No SMTP from address entered — disabling SMTP entirely (Vaultwarden requires both or neither). Re-run this installer to set it up later."
+            SMTP_HOST=""; SMTP_PORT="587"; SMTP_USER=""; SMTP_PASS=""
+        fi
     fi
 
     # Mirrors configure_caddy_for_service's own mode resolution (lib/common.sh):