[Bug]: Secrets not auto-generated during autoadoption from empty DB

[j-chmielewski]

Summary

Auto-adoption from empty database fails with error:

Failed to generate setup token: Failed to read JWT signing key from settings: Missi│obtained during setup
ng required setting: secret_key

Steps to reproduce

1. Precondition: empty, migrated database
2. Run audo-adoption:

cargo run -- --adopt-edge localhost:50051 --adopt-gateway localhost:50066

Expected behavior

Successful adoption

Actual behavior

Errors:

2026-03-25T05:57:27.767232Z  INFO defguard: message=Starting ... version v2.0.0+917f344                                                                                                                                                                                                                                 
2026-03-25T05:57:27.767289Z  INFO defguard_common::db: message=Initializing DB pool                                                                                                                                                                                                                                     
2026-03-25T05:57:27.790684Z  INFO sqlx::postgres::notice: message=relation "_sqlx_migrations" already exists, skipping                                                                                                                                                                                                  
2026-03-25T05:57:27.793170Z  INFO defguard: message=Using HMAC OpenID signing key                                                                                                                                                                                                                                       
2026-03-25T05:57:27.825373Z  INFO defguard_common::db::models::wizard: message=Resuming auto-adoption wizard                                                                                                                                                                                                            
2026-03-25T05:57:27.827880Z DEBUG defguard_setup::auto_adoption: message=Auto-adoption mode: existing CA certificate/key found                                                                                                                                                                                          
2026-03-25T05:57:27.827902Z  INFO defguard_setup::auto_adoption: message=Starting startup auto-adoption for Edge component endpoint=localhost:50051                                                                                                                                                                     
2026-03-25T05:57:27.827975Z DEBUG defguard_setup::auto_adoption: message=Starting edge adoption attempt host=localhost port=50051                                                                                                                                                                                       
2026-03-25T05:57:27.828043Z DEBUG defguard_setup::auto_adoption: message=Successfully validated Edge address: http://localhost:50051                                                                                                                                                                                    
2026-03-25T05:57:27.828073Z DEBUG defguard_setup::auto_adoption: message=Loaded CA certificate for secure Edge communication                                                                                                                                                                                            
2026-03-25T05:57:27.828289Z DEBUG defguard_setup::auto_adoption: message=Prepared secure connection endpoint for Edge at localhost:50051                                                                                                                                                                                
2026-03-25T05:57:27.828305Z DEBUG defguard_setup::auto_adoption: message=Parsed Core version 2.0.0+917f344 for Edge auto-adoption                                                                                                                                                                                       
2026-03-25T05:57:27.828342Z ERROR defguard_setup::auto_adoption: message=Failed to generate setup token: Failed to read JWT signing key from settings: Missing required setting: secret_key [2.0.0 NixOS 26.5.0 x86_64]                                                                                                 
2026-03-25T05:57:27.834571Z  INFO defguard_setup::auto_adoption: message=Startup auto-adoption for Edge component completed endpoint=localhost:50051                                                                                                                                                                    
2026-03-25T05:57:27.834588Z  INFO defguard_setup::auto_adoption: message=Starting startup auto-adoption for Gateway component endpoint=localhost:50066                                                                                                                                                                  
2026-03-25T05:57:27.834607Z DEBUG defguard_setup::auto_adoption: message=Starting gateway adoption attempt host=localhost port=50066                                                                                                                                                                                    
2026-03-25T05:57:27.834634Z DEBUG defguard_setup::auto_adoption: message=Successfully validated Gateway address: http://localhost:50066                                                                                                                                                                                 
2026-03-25T05:57:27.834652Z DEBUG defguard_setup::auto_adoption: message=Loaded CA certificate for secure Gateway communication                                                                                                                                                                                         
2026-03-25T05:57:27.834722Z DEBUG defguard_setup::auto_adoption: message=Prepared secure connection endpoint for Gateway at localhost:50066                                                                                                                                                                             
2026-03-25T05:57:27.834737Z DEBUG defguard_setup::auto_adoption: message=Parsed Core version 2.0.0+917f344 for Gateway auto-adoption                        
2026-03-25T05:57:27.834753Z ERROR defguard_setup::auto_adoption: message=Failed to generate setup token: Failed to read JWT signing key from settings: Missing required setting: secret_key [2.0.0 NixOS 26.5.0 x86_64]
2026-03-25T05:57:27.838801Z  INFO defguard_setup::auto_adoption: message=Startup auto-adoption for Gateway component completed endpoint=localhost:50066     
2026-03-25T05:57:27.839407Z  INFO run_setup_web_server: defguard_setup::setup_server: message=Starting initial setup web server on port 8000                

Defguard version

2.0

Environment details

nixos

Deployment / install method

Custom

Relevant logs / output

Relevant configuration (redacted)