++ mod to MySQL

setup.sh

@@ -4,11 +4,20 @@ set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 ENV_FILE="$SCRIPT_DIR/.env"
 
-if [ -f "$ENV_FILE" ]; then
-  set -a
-  # shellcheck disable=SC1090
-  . "$ENV_FILE"
-  set +a
+if [ ! -f "$ENV_FILE" ]; then
+  echo "No .env found. Copy .env.example to .env and set MYSQL_PASSWORD." >&2
+  exit 1
+fi
+
+set -a
+# shellcheck disable=SC1090
+. "$ENV_FILE"
+set +a
+
+if [ -z "${MYSQL_PASSWORD:-}" ] || [ "${MYSQL_PASSWORD}" = "CHANGE_ME" ]; then
+  echo "MYSQL_PASSWORD is unset or still the placeholder in .env." >&2
+  echo "Generate one with: openssl rand -base64 32" >&2
+  exit 1
 fi
 
 : "${GITEA_UID:=1000}"
@@ -30,6 +39,8 @@ NGINX_DIR="$(resolve_path "$NGINX_CONFIG_DIR")"
 
 mkdir -p "$DATA_DIR" "$CONFIG_DIR" "$NGINX_DIR"
 
+# Only the Gitea bind mounts need this; MySQL uses a named volume and manages
+# its own ownership.
 chown_cmd=(chown -R "${GITEA_UID}:${GITEA_GID}" "$DATA_DIR" "$CONFIG_DIR")
 if [ "$(id -u)" -ne 0 ]; then
   if command -v sudo >/dev/null 2>&1; then
@@ -52,3 +63,12 @@ else
 fi
 
 (cd "$SCRIPT_DIR" && "${COMPOSE_CMD[@]}" up -d)
+
+cat <<EOF
+
+Stack is up. If this is the first run, create the admin user:
+
+  ${COMPOSE_CMD[*]} exec -u git gitea gitea admin user create \\
+    --username admin --email you@example.com --random-password --admin
+
+EOF