secret generation on startup

api/kiwi_vpn_api/config.py

@@ -4,11 +4,12 @@ import functools
 import json
 from datetime import datetime, timedelta
 from enum import Enum
+from secrets import token_hex
 
 from jose import JWTError, jwt
 from jose.constants import ALGORITHMS
 from passlib.context import CryptContext
-from pydantic import BaseModel, BaseSettings, Field
+from pydantic import BaseModel, BaseSettings, Field, validator
 from sqlalchemy import create_engine
 from sqlalchemy.engine import Engine
 
@@ -70,6 +71,14 @@ class JWTConfig(BaseModel):
     hash_algorithm: str = ALGORITHMS.HS256
     expiry_minutes: int = 30
 
+    @validator("secret")
+    @classmethod
+    def ensure_secret(cls, value: str | None) -> str:
+        if value is None:
+            return token_hex(32)
+
+        return value
+
     async def create_token(
         self,
         username: str,