Document .env keys after install and pd1 invite flow.

Installer and operator docs now tell users to read SERVER_PUBLIC_KEY and
SERVER_SEED from /opt/peardock/.env, and how to connect as viewer, admin, or
via a pd1. invite without sharing the seed.

README.md

@@ -44,19 +44,27 @@ curl -fsSL https://install.peardock.boats | bash -s -- --client --yes
 curl -fsSL https://install.peardock.boats | bash -s -- --both --yes
 ```
 
-After the server starts, copy the **public key** from the journal:
+After the server starts **once**, keys are written to **`/opt/peardock/.env`** (mode 600). Check that file first:
 
 ```bash
+# Preferred: keys live in the env file after first start
+sudo grep -E '^(SERVER_PUBLIC_KEY|SERVER_SEED)=' /opt/peardock/.env
+
+# Also printed in the journal on boot
 sudo journalctl -u peardock -n 80 --no-pager | grep -i 'public key'
-# or: sudo systemctl status peardock
 ```
 
+| Variable | Use |
+|----------|-----|
+| `SERVER_PUBLIC_KEY` | Safe to share — paste alone for **viewer** (read-only) |
+| `SERVER_SEED` | **Admin only** — paste with the public key for full admin; never give to operators |
+
 Open the desktop client → **Add peer**:
 
 | Paste | Access |
 |-------|--------|
-| **Public key only** (64 hex) | **Viewer** (read-only) |
-| Public key + **SERVER_SEED** | **Admin** (HMAC proof; seed never stored on disk) |
+| **Public key only** (64 hex from `.env`) | **Viewer** (read-only) |
+| Public key + **SERVER_SEED** (from `.env`) | **Admin** (HMAC proof; seed stays in the client session) |
 | **pd1. invite** (from Access → Create invite) | Role granted by the invite — **no seed sharing** |
 
 Clients use a stable DHT identity and auto-reconnect if the link drops.

docs/OPERATOR.md

@@ -17,9 +17,24 @@ This downloads the Bare server binary from the **`rolling`** release, creates us
 ```bash
 sudo systemctl status peardock
 sudo journalctl -u peardock -f
-# copy public key from logs into the desktop client
 ```
 
+### Keys: check `/opt/peardock/.env`
+
+On first successful start the server writes identity into the env file (mode 600):
+
+```bash
+sudo grep -E '^(SERVER_PUBLIC_KEY|SERVER_SEED)=' /opt/peardock/.env
+# or: sudo cat /opt/peardock/.env
+```
+
+| Variable | Who sees it | Client paste |
+|----------|-------------|--------------|
+| `SERVER_PUBLIC_KEY` | Anyone you trust for read-only | Public key alone → **viewer** |
+| `SERVER_SEED` | Admins only (never share with operators) | Public key + seed → **admin** |
+
+The public key is also printed in the journal. Prefer reading **`.env`** so you have both values in one place.
+
 Desktop client (Linux or macOS):
 
 ```bash
@@ -33,7 +48,7 @@ Flags and Windows notes: [peardock.boats/download](https://peardock.boats/downlo
 | Path | Role |
 |------|------|
 | `/opt/peardock/peardock-server` | Server binary |
-| `/opt/peardock/.env` | Identity / env (mode 600) |
+| `/opt/peardock/.env` | Identity (`SERVER_SEED`, `SERVER_PUBLIC_KEY`) mode 600 |
 | `/etc/systemd/system/peardock.service` | systemd unit |
 | `journalctl -u peardock` | Logs |
 

scripts/install.sh

@@ -462,10 +462,10 @@ EOF
     if confirm "Enable and start peardock.service now?" "y"; then
       run_root systemctl enable --now peardock.service
       ok "Service peardock.service is enabled and started"
-      sleep 1
+      # First start generates SERVER_SEED + SERVER_PUBLIC_KEY into .env
+      sleep 2
       run_root systemctl --no-pager --full status peardock.service || true
       log "Logs: journalctl -u peardock -f"
-      log "Public key (if ready): journalctl -u peardock -n 50 --no-pager | grep -i 'public key' || true"
     else
       ok "Unit installed. Start later with: sudo systemctl enable --now peardock"
     fi
@@ -473,15 +473,58 @@ EOF
     warn "systemctl not found — binary installed at ${SERVER_DIR}/peardock-server (start manually)"
   fi
 
+  # Prefer showing public key from .env once the server has written it (never print seed)
+  local env_pk=""
+  if [[ -f "${SERVER_DIR}/.env" ]]; then
+    env_pk="$(run_root grep -E '^SERVER_PUBLIC_KEY=' "${SERVER_DIR}/.env" 2>/dev/null | head -1 | cut -d= -f2- | tr -d '[:space:]' || true)"
+  fi
+
   cat <<EOF
 
 ${C_BOLD}Server installed${C_RESET}
   Binary:  ${SERVER_DIR}/peardock-server
-  Config:  ${SERVER_DIR}/.env
+  Config:  ${SERVER_DIR}/.env   ${C_BOLD}← check this file for your keys${C_RESET}
   Service: peardock.service
 
-  Share the server ${C_BOLD}public key${C_RESET} with clients (printed in logs on first start).
-  Never share SERVER_SEED.
+${C_BOLD}Keys (written on first successful start)${C_RESET}
+  After peardock has started once, open the env file:
+
+    sudo grep -E '^(SERVER_PUBLIC_KEY|SERVER_SEED)=' ${SERVER_DIR}/.env
+    # or:  sudo cat ${SERVER_DIR}/.env
+
+  ${C_BOLD}SERVER_PUBLIC_KEY${C_RESET}  64 hex — share with clients (viewer if used alone)
+  ${C_BOLD}SERVER_SEED${C_RESET}         64 hex — ${C_BOLD}admin only${C_RESET}; never share with operators
+
+EOF
+
+  if [[ -n "$env_pk" && ${#env_pk} -eq 64 ]]; then
+    cat <<EOF
+  ${C_GREEN}SERVER_PUBLIC_KEY (from .env):${C_RESET}
+  ${env_pk}
+
+EOF
+  else
+    cat <<EOF
+  If keys are missing, start/restart once then re-check .env:
+    sudo systemctl enable --now peardock
+    sudo systemctl restart peardock
+    sudo grep -E '^(SERVER_PUBLIC_KEY|SERVER_SEED)=' ${SERVER_DIR}/.env
+
+  Journal (also prints the public key on boot):
+    sudo journalctl -u peardock -n 80 --no-pager | grep -i 'public key'
+
+EOF
+  fi
+
+  cat <<EOF
+${C_BOLD}Connect from the desktop client → Add peer${C_RESET}
+  · Public key only              → viewer (read-only)
+  · Public key + SERVER_SEED     → admin
+  · Full pd1.… invite            → role from invite (operators; no seed)
+
+  Operators: as admin open ${C_BOLD}Access → Create invite${C_RESET}, copy the full pd1. string,
+  and share that invite (never SERVER_SEED).
+  Docs: https://peardock.boats/docs/quickstart
 
 EOF
 }
@@ -593,6 +636,14 @@ ${C_BOLD}Client installed (macOS)${C_RESET}
   If Gatekeeper blocks it: right-click → Open, or:
     xattr -cr "$app"
 
+  Connect (Add peer):
+  · Server public key (SERVER_PUBLIC_KEY in the host .env) → viewer
+  · Public key + SERVER_SEED → admin (never share the seed)
+  · Full pd1. invite from an admin → operator without the seed
+
+  On the Docker host:
+    sudo grep -E '^(SERVER_PUBLIC_KEY|SERVER_SEED)=' /opt/peardock/.env
+
 EOF
       else
         warn "peardock.app not found — files are in $client_dir"
@@ -618,7 +669,12 @@ ${C_BOLD}Client installed (Linux)${C_RESET}
   Run:  peardock-client
     or: ${bin}
 
-  Paste the server public key in the sidebar to connect.
+  Connect (Add peer):
+  · Server public key (from /opt/peardock/.env → SERVER_PUBLIC_KEY) → viewer
+  · Public key + SERVER_SEED (same .env; admin only) → admin
+  · Full pd1. invite from an admin → operator/admin without the seed
+
+  On the Docker host:  sudo grep -E '^(SERVER_PUBLIC_KEY|SERVER_SEED)=' /opt/peardock/.env
 
 EOF
       if confirm "Launch peardock-client now?" "n"; then