simplerisk-minimal: harden config.php substitution against / in values

[jsokol]

Summary

• Switches the set_config / set_db_password sed substitutions to a | delimiter with proper escaping. The previous / delimiter silently failed whenever an env-var value contained / (cert paths, passwords with special chars), and the trailing || true on the optional fields hid the failure — the bundled default ended up in config.php instead.
• Updates the SIMPLERISK_DB_SSL_CERT_PATH handling to match both the new commented-out sample form (// define('DB_SSL_CERTIFICATE_PATH', '/path/to/ca-cert.pem');) and the legacy uncommented form. When the env var is set, the line is rewritten as an active define; when unset, the commented sample form is left in place so SimpleRisk doesn't request SSL against a non-existent cert path.
• Defaults SIMPLERISK_DB_FOR_SESSIONS to 'true' to match the README's documented default and to avoid leaving the literal __USE_DATABASE_FOR_SESSIONS__ placeholder in config.php when an operator omits the env var alongside the new sample format.

Test plan

• CI shellcheck passes (severity=error)
• CI container-validation builds the simplerisk-minimal variants
• Verified locally in a Debian container against four scenarios:
  • New sample format + all env vars set, including an SSL cert path containing / and a password containing /, &, |, \ — all values substituted correctly
  • New sample format + no env vars — defaults applied for the standard fields, SSL line stays commented out, sessions defaults to 'true'
  • Legacy persisted config.php fallback (no sample file) + env vars set — substitutions update the existing define lines correctly
  • Legacy persisted config.php fallback + no env vars — defaults applied, existing SSL value preserved

Notes

• Behavior change worth calling out in release notes: operators on a persisted volume who had USE_DATABASE_FOR_SESSIONS = 'false' and don't set SIMPLERISK_DB_FOR_SESSIONS will be flipped to 'true' on next boot. The README already advertised true as the default; this just brings the entrypoint into line. To preserve 'false', set SIMPLERISK_DB_FOR_SESSIONS=false.
• The simplerisk (full-stack) image isn't touched: it generates its DB password from tr -dc A-Za-z0-9 and uses literal hardcoded values for the other fields, so it doesn't hit the /-in-value bug.

🤖 Generated with Claude Code