don't overwrite secrets on setup

main.go

@@ -1558,22 +1558,50 @@ if [ ! -x "$binary" ]; then
 fi
 env_file="%s"
 data_dir="%[5]s"
-current_port=""
-current_data_dir=""
-	if [ -f "$env_file" ]; then
-  current_port=$(grep '^PORT=' "$env_file" | head -n 1 | cut -d= -f2 || true)
-  current_data_dir=$(grep '^POCKETBASE_DATA_DIR=' "$env_file" | head -n 1 | cut -d= -f2 || true)
- fi
 if [ -n "$data_dir" ]; then
   mkdir -p "$data_dir"
 fi
-if [ "$current_port" != "%d" ] || [ "$current_data_dir" != "%[5]s" ]; then
+if [ ! -f "$env_file" ]; then
   cat <<'EOF' > "$env_file"
-PORT=%d
+PORT=%[6]d
 POCKETBASE_DATA_DIR=%[5]s
 EOF
+else
+  current_port=$(grep '^PORT=' "$env_file" | head -n 1 | cut -d= -f2 || true)
+  current_data_dir=$(grep '^POCKETBASE_DATA_DIR=' "$env_file" | head -n 1 | cut -d= -f2 || true)
+  if [ "$current_port" != "%[6]d" ] || [ "$current_data_dir" != "%[5]s" ]; then
+    tmp=$(mktemp)
+    awk -v port="%[6]d" -v datadir="%[5]s" '
+/^PORT=/ {
+  if (port_set == 0) {
+    printf "PORT=%s\n", port
+    port_set = 1
+  }
+  next
+}
+/^POCKETBASE_DATA_DIR=/ {
+  if (data_set == 0) {
+    printf "POCKETBASE_DATA_DIR=%s\n", datadir
+    data_set = 1
+  }
+  next
+}
+{
+  print
+}
+END {
+  if (port_set == 0) {
+    printf "PORT=%s\n", port
+  }
+  if (data_set == 0) {
+    printf "POCKETBASE_DATA_DIR=%s\n", datadir
+  }
+}
+' "$env_file" > "$tmp"
+    mv "$tmp" "$env_file"
   fi
-`, serviceDir, serviceDir, assetURL, envFile, volume, port, port)
+fi
+`, serviceDir, serviceDir, assetURL, envFile, volume, port)
 }
 
 func systemdScript(serviceDir, envFile, serviceName string) string {