From 46d9c852ab8a6928a34e4a36035485250c92685f Mon Sep 17 00:00:00 2001
From: Debian <debian@vps-7ed4abb0.vps.ovh.net>
Date: Tue, 17 Mar 2026 02:00:37 +0000
Subject: [PATCH] Security: Replace hardcoded passwords with placeholders

- Replace kawa:kawa123@100.64.0.1:4222 with NATS placeholders
- Replace initialPassword 'kawa2026' with <INITIAL_PASSWORD>
- Update README with password placeholders
- Add security notes for default credentials

Safe for public release.
---
 kawa-voice-install.sh     | 2 +-
 modules/kawa-physical.nix | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/kawa-voice-install.sh b/kawa-voice-install.sh
index 9f9bcaa..7100490 100755
--- a/kawa-voice-install.sh
+++ b/kawa-voice-install.sh
@@ -87,7 +87,7 @@ import pyaudio
 import pyttsx3
 
 # Configuration
-NATS_SERVER = "ws://kawa:kawa123@100.64.0.1:4222"
+NATS_SERVER = "ws://<NATS_USER>:<NATS_PASSWORD>@<NATS_SERVER>"
 OLLAMA_SERVER = "http://100.64.0.7:11434"
 MODEL_PATH = os.path.expanduser("~/.local/share/vosk/vosk-model-fr")
 
diff --git a/modules/kawa-physical.nix b/modules/kawa-physical.nix
index c79918e..856dd77 100644
--- a/modules/kawa-physical.nix
+++ b/modules/kawa-physical.nix
@@ -63,7 +63,7 @@
   users.users.kawa = {
     isNormalUser = true;
     extraGroups = [ "wheel" "networkmanager" "tailscale" ];
-    initialPassword = "kawa2026";
+    initialPassword = "<INITIAL_PASSWORD>";
   };
 
   # Firewall