this post was submitted on 11 Jul 2025

652 points (95.5% liked)

You Should Know

39738 readers

740 users here now

YSK - for all the things that can make your life easier!

The rules for posting and commenting, besides the rules defined here for lemmy.world, are as follows:

Rules (interactive)

Rule 1- All posts must begin with YSK.

All posts must begin with YSK. If you're a Mastodon user, then include YSK after @youshouldknow. This is a community to share tips and tricks that will help you improve your life.

Rule 2- Your post body text must include the reason "Why" YSK:

**In your post's text body, you must include the reason "Why" YSK: It’s helpful for readability, and informs readers about the importance of the content. **

Rule 3- Do not seek mental, medical and professional help here.

Do not seek mental, medical and professional help here. Breaking this rule will not get you or your post removed, but it will put you at risk, and possibly in danger.

Rule 4- No self promotion or upvote-farming of any kind.

That's it.

Rule 5- No baiting or sealioning or promoting an agenda.

Posts and comments which, instead of being of an innocuous nature, are specifically intended (based on reports and in the opinion of our crack moderation team) to bait users into ideological wars on charged political topics will be removed and the authors warned - or banned - depending on severity.

Rule 6- Regarding non-YSK posts.

Provided it is about the community itself, you may post non-YSK posts using the [META] tag on your post title.

Rule 7- You can't harass or disturb other members.

If you harass or discriminate against any individual member, you will be removed.

If you are a member, sympathizer or a resemblant of a movement that is known to largely hate, mock, discriminate against, and/or want to take lives of a group of people and you were provably vocal about your hate, then you will be banned on sight.

For further explanation, clarification and feedback about this rule, you may follow this link.

Rule 8- All comments should try to stay relevant to their parent content.

Rule 9- Reposts from other platforms are not allowed.

Let everyone have their own content.

Rule 10- The majority of bots aren't allowed to participate here.

Unless included in our Whitelist for Bots, your bot will not be allowed to participate in this community. To have your bot whitelisted, please contact the moderators for a short review.

Rule 11- Posts must actually be true: Disiniformation, trolling, and being misleading will not be tolerated. Repeated or egregious attempts will earn you a ban. This also applies to filing reports: If you continually file false reports YOU WILL BE BANNED! We can see who reports what, and shenanigans will not be tolerated.

If you file a report, include what specific rule is being violated and how.

Partnered Communities:

You can view our partnered communities list by following this link. To partner with our community and be included, you are free to message the moderators or comment on a pinned post.

Community Moderation

For inquiry on becoming a moderator of this community, you may comment on the pinned post of the time, or simply shoot a message to the current moderators.

Credits

Our icon(masterpiece) was made by @clen15!

founded 2 years ago

MODERATORS

Thekingoflorda@lemmy.world

_MoveSwiftly@lemmy.world

ja2@lemmy.world

Rooki@lemmy.world

FartsWithAnAccent@lemmy.world

FartsWithAnAccent@fedia.io

652

YSK: If you set up a Lemmy instance, and follow the Docker setup instructions to the letter, it will send lemmy.ml your admin password during the setup process (Edit: Not anymore, it’s fixed now) (ponder.cat)

submitted 1 day ago* (last edited 1 day ago) by PhilipTheBucket@ponder.cat to c/youshouldknow@lemmy.world

172 comments fedilink hide all child comments

So if you do the Docker setup, obeying the instructions and substituting everything that needs to get substituted, but don't proofread the files in detail and so miss that line 40 of docker-compose.yml doesn't have the variable {{domain}} like in every other location you need to write your domain, but instead just says LEMMY_UI_LEMMY_EXTERNAL_HOST=lemmy.ml and so you fail to change it away from lemmy.ml... then, everything will work, until you type in your admin password for the first time, at which point your browser will send a request to lemmy.ml which includes your admin username, your email address, and the admin password you're trying to set. And, also, of course your IP address wherever you are sitting and setting up the server.

I have no reason at all to think the Lemmy devs have set their server up to log this information when it comes in. nginx will throw it away by default, of course, but it would be easy for them to have it save it instead, if they wanted to. And my guess is most people won't use a different admin password once they figure out why creating their admin user isn't working and fix it.

@dessalines@lemmy.ml @nutomic@lemmy.ml I think you should fix the docker-compose.yml file not to do this.

Edit: Just to increase the information-to-rudeness ratio of my post. The docs are at:

https://join-lemmy.org/docs/administration/install_docker.html

And they recommend using wget to download:

https://raw.githubusercontent.com/LemmyNet/lemmy-docs/main/assets/docker-compose.yml

Which is pulled from:

https://github.com/LemmyNet/lemmy-docs/tree/main/assets

Which is what has the wrong line 40 in it.

Edit: They fixed it. Good stuff.

you are viewing a single comment's thread
view the rest of the comments

[–] dastanktal@lemmy.ml 10 points 1 day ago (9 children)

Go fix it yourself. You're correct that's the admin's problem but if you're so insistent that it takes a minute go submit a merge request real quick.

Also it's only a security breach if you don't change the admin password or your domain which should be standard for setting things up on the Internet anyway.

[–] uranibaba@lemmy.world 9 points 1 day ago (8 children)

I would fix it if we had a link. This problem is not present in the main branch.

https://github.com/LemmyNet/lemmy/blob/main/docker/docker-compose.yml

environment:
      # this needs to match the hostname defined in the lemmy service
      - LEMMY_UI_LEMMY_INTERNAL_HOST=lemmy:8536
      # set the outside hostname here
      - LEMMY_UI_LEMMY_EXTERNAL_HOST=localhost:1236
      - LEMMY_UI_HTTPS=false
      - LEMMY_UI_DEBUG=true

[–] PhilipTheBucket@ponder.cat 6 points 1 day ago* (last edited 1 day ago) (7 children)

It's present in the link on:

https://join-lemmy.org/docs/administration/install_docker.html

Which refers people to download:

https://raw.githubusercontent.com/LemmyNet/lemmy-docs/main/assets/docker-compose.yml

What you're linking to is not what the live docs link to. I don't know what main/docker is for, but the docs link to main/assets, not there.

[–] uranibaba@lemmy.world 4 points 1 day ago (1 children)

You are right, that is sus. The main repo does not have this and the docs repo have the main as a sub module, but still have a folder named assets with a different docker-compose.yml.

Would have been nice with a link from the start.

[–] PhilipTheBucket@ponder.cat 3 points 1 day ago

Would have been nice with a link from the start.

Yeah, 100%. I edited the post to add more of the details.

load more comments (5 replies)