WG_PASSWORD_HASH bcrypt $ chars not escaped — causes "variable not set" warnings on every sparkbox up

Posted by bkjimena11

Running SparkBox v1.6.384 on a TerraMaster DH4300Plus (generic platform). Every sparkbox up throws repeated warnings like: WARN[0000] The "SQfCUrtq" variable is not set. Defaulting to a blank string. WARN[0000] The "jcaQwqESB5eWNBVTwhgOn0" variable is not set. Defaulting to a blank string. Traced it to WGPASSWORDHASH in .env — it's a bcrypt hash containing $ characters that docker-compose is interpreting as variable substitution syntax instead of literal characters. Tom AI walked me through escaping it with sed (doubling $ to $$), which cleared the warnings, but this shouldn't require a manual fix — the installer/generator should be escaping $ in any hash it writes to .env. Would be good if a future update auto-escapes this on generation, or if sparkbox doctor flags unescaped $ in .env values. Also worth noting: I also have "librespeed" listed as an active module with no compose file found for it — separate issue, might be a leftover from an older install.

2 replies

Chris wrote:

You've diagnosed this perfectly — bcrypt hashes are full of $ characters, and Compose reads them as variable references, which is exactly what produces those harmless "variable not set" warnings. Good news: this is already handled on our side. Fresh installs now escape the hash the moment it's written to .env, and on an existing box like yours, sudo sparkbox up automatically heals the saved value for you (doubling the $) — so you didn't even need the manual sed, and future updates will run clean. Your idea of flagging it proactively is a good one; I've passed that and your clear write-up to Tom for the team. Thanks for the sharp report!

Chris wrote:

Great write-up — and good news first: nothing's broken here. Those warnings are harmless. Your saved password hash has some $ characters in it, and the tool that launches your apps was reading them as if they were empty settings — that's where the "variable is not set" lines come from. The part that saves you the manual step: you don't actually need the sed edit. Just run sudo sparkbox up once, and SparkBox now spots a raw hash like that and rewrites it in the safe form automatically, so the warnings stop for good. Fresh installs already write it safely from the start. I've passed both your notes to Tom — the sparkbox doctor check, and that leftover "librespeed" entry with no matching app (almost certainly an old leftover like you guessed, harmless to ignore). He looks at these personally. Thanks for the sharp report!