don't allow users to just mount the prime db i guess for privacy reasons (may undo this someday)

update-deployed.sh

@@ -70,6 +70,42 @@ else
   echo "Dependencies unchanged; skipping npm install."
 fi
 
+if [[ ! -f .env ]]; then
+  install -m 600 /dev/null .env
+else
+  chmod 600 .env || true
+fi
+
+if ! grep -Eq '^SESSION_SECRET=.+$' .env; then
+  SESSION_SECRET_VALUE="$(
+    node -e 'process.stdout.write(require("crypto").randomBytes(48).toString("base64url"))'
+  )"
+  if grep -Eq '^SESSION_SECRET=' .env; then
+    ENV_TMP="$(mktemp)"
+    awk -v secret="$SESSION_SECRET_VALUE" '
+      BEGIN { replaced = 0 }
+      /^SESSION_SECRET=/ {
+        if (!replaced) {
+          print "SESSION_SECRET=" secret
+          replaced = 1
+        }
+        next
+      }
+      { print }
+      END {
+        if (!replaced) print "SESSION_SECRET=" secret
+      }
+    ' .env >"$ENV_TMP"
+    cat "$ENV_TMP" >.env
+    rm -f "$ENV_TMP"
+  else
+    printf '\nSESSION_SECRET=%s\n' "$SESSION_SECRET_VALUE" >>.env
+  fi
+  echo "Generated SESSION_SECRET in $APP_DIR/.env"
+else
+  echo "SESSION_SECRET already present in $APP_DIR/.env"
+fi
+
 PM2_TARGET=""
 if command -v pm2 >/dev/null 2>&1; then
   PM2_TARGET="$(pm2 jlist 2>/dev/null | APP_DIR="$APP_DIR" node -e '