From f1349a15500aff4ab35c2b36fcd0ad6211ecb4da Mon Sep 17 00:00:00 2001
From: Wu Qing <3184394176@qq.com>
Date: Sun, 9 Aug 2026 13:43:02 +0800
Subject: [PATCH] =?UTF-8?q?fix(config):=20=E6=94=AF=E6=8C=81=E4=BB=8E?=
 =?UTF-8?q?=E7=8E=AF=E5=A2=83=E5=8F=98=E9=87=8F=E5=8A=A0=E8=BD=BD=E5=AE=89?=
 =?UTF-8?q?=E5=85=A8=E5=AF=86=E9=92=A5?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 server/internal/config/config.go      |  2 ++
 server/internal/config/config_test.go | 16 ++++++++++++++++
 2 files changed, 18 insertions(+)

diff --git a/server/internal/config/config.go b/server/internal/config/config.go
index 33871fe..9be5052 100644
--- a/server/internal/config/config.go
+++ b/server/internal/config/config.go
@@ -169,7 +169,9 @@ func applyDefaults(v *viper.Viper) {
 	v.SetDefault("server.trusted_proxies", []string{"127.0.0.1", "::1"})
 	v.SetDefault("server.web_root", "")
 	v.SetDefault("database.path", "./data/backupx.db")
+	v.SetDefault("security.jwt_secret", "")
 	v.SetDefault("security.jwt_expire", "24h")
+	v.SetDefault("security.encryption_key", "")
 	v.SetDefault("backup.temp_dir", "/tmp/backupx")
 	v.SetDefault("backup.max_concurrent", 2)
 	v.SetDefault("backup.retries", 10)
diff --git a/server/internal/config/config_test.go b/server/internal/config/config_test.go
index 3e59894..a0fe67a 100644
--- a/server/internal/config/config_test.go
+++ b/server/internal/config/config_test.go
@@ -72,6 +72,22 @@ func TestLoadReadsServerExternalURLFromEnv(t *testing.T) {
 	}
 }
 
+func TestLoadReadsSecuritySecretsFromEnv(t *testing.T) {
+	t.Setenv("BACKUPX_SECURITY_JWT_SECRET", "test-jwt-secret")
+	t.Setenv("BACKUPX_SECURITY_ENCRYPTION_KEY", "test-encryption-key")
+
+	cfg, err := Load("")
+	if err != nil {
+		t.Fatalf("Load returned error: %v", err)
+	}
+	if cfg.Security.JWTSecret != "test-jwt-secret" {
+		t.Fatalf("expected JWT secret from env, got %q", cfg.Security.JWTSecret)
+	}
+	if cfg.Security.EncryptionKey != "test-encryption-key" {
+		t.Fatalf("expected encryption key from env, got %q", cfg.Security.EncryptionKey)
+	}
+}
+
 func TestLoadReadsTrustedProxiesFromEnv(t *testing.T) {
 	t.Setenv("BACKUPX_SERVER_TRUSTED_PROXIES", "127.0.0.1,172.18.0.0/16")
 	cfg, err := Load("")