#!/bin/sh
# Generates a random 256-bit AES key for the REX_SECURITY_MASTER_KEY environment
# variable. Run this ONCE per installation, before the first startup, then store
# the output somewhere safe (secrets manager, password vault, or a root-only
# file) - it is the key that decrypts every SSO client secret, connector
# credential, and AI provider API key Rest Exchange stores. If it is lost,
# those stored secrets become unrecoverable and will need to be re-entered.
openssl rand -base64 32