The CHISEL_KEY environment variable was being ignored when the --keyfile flag was not provided, causing the server to generate random keys on each startup instead of using the consistent key from the environment variable.

Problem

The issue was in the conditional logic in main.go lines 238-242:

if config.KeyFile == "" {
    config.KeyFile = settings.Env("KEY_FILE")
} else if config.KeySeed == "" {  // <- This else if was the problem
    config.KeySeed = settings.Env("KEY")
}

With this logic:

• If --keyfile is not set, check for CHISEL_KEY_FILE environment variable
• BUT only if CHISEL_KEY_FILE is also empty, then check for CHISEL_KEY

This meant CHISEL_KEY was never checked when --keyfile wasn't provided.

Reproduction

Before the fix:

$ CHISEL_KEY=foo ./chisel server
2025/09/11 11:37:31 server: Fingerprint pNPdEW6Jua3VUGxyPTVRP6aa1zK+eHMKAgQF05KakRg=

$ CHISEL_KEY=foo ./chisel server  
2025/09/11 11:37:32 server: Fingerprint xTMln7cxGPrdQzA24ngO6MGWl3TaiHBww7EIEhOMP0o=  # Different!

Solution

Changed the else if to a separate if statement, making the environment variable checks independent:

if config.KeyFile == "" {
    config.KeyFile = settings.Env("KEY_FILE")
}
if config.KeySeed == "" {
    config.KeySeed = settings.Env("KEY")
}

Verification

After the fix:

$ CHISEL_KEY=foo ./chisel server
2025/09/11 12:07:29 server: Fingerprint HP0ROQhzJtI11mppkeKVFTWPbahaAgAlsSmBUB6JYEU=

$ CHISEL_KEY=foo ./chisel server
2025/09/11 12:07:38 server: Fingerprint HP0ROQhzJtI11mppkeKVFTWPbahaAgAlsSmBUB6JYEU=  # Same!

The fix preserves all existing behavior:

• CHISEL_KEY_FILE still takes precedence over CHISEL_KEY when both are set
• --keyfile flag still works as expected
• --key flag still works (with deprecation warning)

Added comprehensive tests to prevent regression of this issue.

Fixes #570.

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.