TODO

• tasks/01_admin.yml:8 hands the administrator password to the container as -e ADMIN_PASSWORD=… on the container exec command line, so it is readable in the process list of the stack host while the task runs and in the task’s cmd wherever MASK_CREDENTIALS_IN_LOGS is off (read from the role file, not measured in a process list). Options: write the value to the stdin of the script together with the script body, or pass --env-file with a 0600 file that the task removes again.

• files/shell/admin/user.sh:18 passes that password to bin/console user:create as --password="$ADMIN_PASSWORD", so it is in the argument list of the PHP process inside the web container (read from the role file). Options: let user:create prompt and feed the prompt through stdin, or create the user with a random throwaway password and set the real one through the Admin API.

• files/shell/admin/user.sh:23 passes the same password to bin/console user:change-password as --password=… (read from the role file). Options: feed the interactive prompt of user:change-password through stdin, or update the password through PATCH /api/user/<id> with the body on stdin.

• tasks/setup/oidc.yml:25 hands the administrator password and tasks/setup/oidc.yml:30 the Keycloak client secret to files/php/oidc/client.php as -e ADMIN_PASSWORD=… and -e OIDC_CLIENT_SECRET=… on the container exec command line (read from the role file; sso was disabled on the stack of the design pass). Options: send both as a JSON document on stdin after the script, or mount them through --env-file with a 0600 file.

• files/shell/init.sh:110-112 generates the lock password of the installer’s admin account and passes it to bin/console user:change-password admin --password=…, so it is in the argument list of that process during the first start (read from the role file). Options: feed the prompt of user:change-password through stdin, or deactivate the account with one UPDATE through the existing PDO connection instead of setting a password.

• Every fresh load of /admin by a signed-in administrator is redirected to #/sw/first/run/wizard/index/ (measured on the compose stack: the dashboard URL ends on the wizard route until a hash navigation leaves it), because files/shell/init.sh installs with --basic-setup and never completes the first-run wizard. Options: add --skip-first-run-wizard to system:install for new installations, or set core.frw.completedAt through bin/console system:config:set for existing ones.

• The administration sign-in page names https://login-image.shopware.com/login/login.jpg as its first background image, a request to the vendor on every visit (read from the administration stylesheet, rule .sw-login .sw-login__image; whether the content security policy lets the request through was not measured, and the design stylesheet removes the image, so this only concerns deployments with design disabled). Options: keep the host out of img-src in meta/csp.yml so the bundled fallback image is used, or allow the request and document it.