Harden Docker defaults for admin bootstrap and secrets

[pparage]

Motivation

• Remove insecure Docker defaults that created a predictable admin/password account and exposed static Flask signing secrets, which allowed remote takeover when the container was run with defaults.
• Make admin bootstrap and signing material opt-in or configurable so deployed containers do not ship public credentials or fixed SECRET_KEY values.

Description

• Change entrypoint.sh so flask create_admin runs only when MOSP_ADMIN_PASSWORD is explicitly provided, with optional MOSP_ADMIN_LOGIN and MOSP_ADMIN_EMAIL overrides, instead of always creating admin/password.
• Update instance/docker.py to import secrets and set SECRET_KEY and SECURITY_PASSWORD_SALT from environment variables with secure random fallbacks via secrets.token_urlsafe(32).
• Preserve existing behavior for users who explicitly provide SECRET_KEY, SECURITY_PASSWORD_SALT, or MOSP_ADMIN_* environment variables while removing unsafe defaults.

Testing

• Ran bash -n entrypoint.sh which returned no syntax errors and succeeded.
• Ran python -m py_compile instance/docker.py which completed successfully with no compilation errors.

---

Codex Task

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2763e6b28a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Generate stable secret defaults across workers

SECRET_KEY and SECURITY_PASSWORD_SALT are now generated with secrets.token_urlsafe(32) at import time, so each Gunicorn worker gets different values when env vars are unset. In this repo the entrypoint launches gunicorn --workers 2, so session cookies/CSRF tokens issued by one worker are invalid on requests handled by the other, causing intermittent logouts and form failures in the default Docker deployment. The fallback needs to be process-stable (shared env/file/derived once before workers) rather than per-worker random generation.

Useful? React with 👍 / 👎.

[pparage]

0.18 PR request fixes this