From 3601bb4d36668c9b99e5946d5ddb4bbcce8c1920 Mon Sep 17 00:00:00 2001
From: Julian Sommer <115516918+juliansommer@users.noreply.github.com>
Date: Mon, 10 Aug 2026 10:40:50 +1000
Subject: [PATCH] fix: don't output secret keys on installs

---
 cmd/installer/firstboot/firstboot.go | 3 ++-
 cmd/installer/systemd/systemd.go     | 2 ++
 cmd/spinifex/cmd/admin.go            | 7 ++++---
 3 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/cmd/installer/firstboot/firstboot.go b/cmd/installer/firstboot/firstboot.go
index bbe1519d1..409aa0690 100644
--- a/cmd/installer/firstboot/firstboot.go
+++ b/cmd/installer/firstboot/firstboot.go
@@ -156,7 +156,8 @@ resolvconf -u
 # Write the banner (first time, spinifex-banner service will do this on reboot)
 /usr/local/bin/spx admin banner --boot-check
 
-# Cluster formation — capture credentials to file for display on console.
+# Cluster formation. Output goes to the journal via the systemd unit; spx
+# admin init writes credentials to disk and never prints them.
 %s 2>&1
 
 # Fix ownership of files spx admin init wrote. spx runs as root under
diff --git a/cmd/installer/systemd/systemd.go b/cmd/installer/systemd/systemd.go
index 122517873..6898bef1b 100644
--- a/cmd/installer/systemd/systemd.go
+++ b/cmd/installer/systemd/systemd.go
@@ -68,6 +68,8 @@ ExecStopPost=/bin/sh -c 'if [ "$EXIT_STATUS" != "0" ]; then printf "\n*** Spinif
 # ovn-central startup cannot wedge multi-user.target and keep getty from
 # ever reaching the login prompt.
 TimeoutStartSec=300s
+# Install diagnostics land in the journal, which persists for the life of the
+# node — nothing this script runs may print secrets to stdout or stderr.
 StandardOutput=journal
 StandardError=journal
 
diff --git a/cmd/spinifex/cmd/admin.go b/cmd/spinifex/cmd/admin.go
index 33803d13f..0742dcdb3 100644
--- a/cmd/spinifex/cmd/admin.go
+++ b/cmd/spinifex/cmd/admin.go
@@ -1405,9 +1405,10 @@ func runAdminInit(cmd *cobra.Command, args []string) {
 	fmt.Printf("   Key: %s\n", viperblockKeyPath)
 
 	if !masterKeyExisted {
-		fmt.Printf("\n🔑 Generated admin credentials (save these — they won't be shown again):\n")
-		fmt.Printf("   Access Key:  %s\n", adminAccessKey)
-		fmt.Printf("   Secret Key:  %s\n", adminSecretKey)
+		// Never echo the keys: on an ISO install stdout is the systemd journal,
+		// which persists them for the life of the node. They are recoverable from
+		// bootstrap.json and ~/.aws/credentials.
+		fmt.Printf("\n🔑 Generated admin credentials (written to ~/.aws/credentials)\n")
 		fmt.Printf("   Account:     %s (%s)\n", admin.DefaultAccountName(), admin.DefaultAccountID())
 		fmt.Printf("   AWS Profile: spinifex\n")
 	}