[horde] Horde refuses to create "secret_key" automatically on fresh install

[Sebastian Arcus]

I'm not sure if this is particular to my own setup or a generic issue. I 
installed Horde6 using the steps below:

$ cd /srv/lighttpd/horde6.mydomain.com/
$ composer create-project horde/bundle .
$ composer require horde/timeobjects  horde/content
$ cp ./vendor/horde/horde/config/conf.php.dist ./var/config/horde/conf.php

When trying to load https://horde6.mydomain.com, I get the error "520 
Bad Gateway". After enabling test.php, I get the error message below:


Error: Cannot create Horde_Secret_Cbc Root cause: Horde_Core_Secret_Cbc: 
key_format 'hkdf-with-legacy-fallback' requires a non-empty 'secret_key' 
constructor parameter. HKDF derivation over empty master secret would 
produce a predictable per-session key. Set a strong $conf['secret_key'] 
in horde/conf.php, or switch key_format to 'legacy-only' (rollback mode).



It all works fine if I copy manually the "secret_key" from conf.php 
entry from a working installation of Horde, or generate one with 
OpenSSL. Is the key supposed to be generated manually and added to 
conf.php? Maybe it is in the instructions and I missed it?


I am on PHP 8.4.22 and Lighttpd 1.4.82