docs: update WEED_S3_SSE_KEY to use any string instead of hex

Environment-Variables.md

@@ -81,15 +81,11 @@ WEED_HTTPS_CLIENT_CA=/path/to/ca.crt
 
 ### SSE-S3 Encryption Key (KEK)
 ```shell
-# Hex-encoded 256-bit key used as the Key Encryption Key for SSE-S3.
-# When set, the S3 API server uses this key instead of storing a KEK
+# Any secret string used to derive the Key Encryption Key for SSE-S3.
+# A 256-bit key is derived from this value using HKDF-SHA256.
+# When set, the S3 API server uses this instead of storing a KEK
 # on the filer at /etc/s3/sse_kek.
-WEED_S3_SSE_KEY=<64 hex chars>
-```
-
-Generate a key:
-```shell
-openssl rand -hex 32
+WEED_S3_SSE_KEY=my-secret-passphrase
 ```
 
 See [[Server-Side-Encryption]] for details.

Server-Side-Encryption.md

@@ -123,17 +123,16 @@ SSE-S3 uses envelope encryption: a Key Encryption Key (KEK) protects per-object
 
 ### Recommended: Environment Variable
 
-Set `WEED_S3_SSE_KEY` to a hex-encoded 256-bit key:
+Set `WEED_S3_SSE_KEY` to any secret string. A 256-bit key is derived from it automatically using HKDF-SHA256:
 
 ```bash
-# Generate a key
-export WEED_S3_SSE_KEY=$(openssl rand -hex 32)
+export WEED_S3_SSE_KEY=my-secret-passphrase
 
 # Start the S3 API server
 weed s3 -filer=localhost:8888
 ```
 
-The key never touches the filer filesystem. Store it in your secrets manager (Vault, AWS Secrets Manager, Kubernetes Secrets, etc.) and inject it as an environment variable at startup.
+The same secret always produces the same derived key, so all S3 API servers in a cluster must use the same value. The secret never touches the filer filesystem. Store it in your secrets manager (Vault, AWS Secrets Manager, Kubernetes Secrets, etc.) and inject it as an environment variable at startup.
 
 ### Legacy: Filer-Stored KEK (deprecated for new deployments)
 
@@ -141,12 +140,9 @@ If `WEED_S3_SSE_KEY` is not set, SeaweedFS falls back to loading the KEK from `/
 
 ### Migration from Filer KEK to Environment Variable
 
-1. Read the existing KEK from the filer: `weed shell` → `fs.cat /etc/s3/sse_kek`
-2. Set the environment variable: `export WEED_S3_SSE_KEY=<value from step 1>`
-3. Restart the S3 API server — it will use the env var and skip the filer lookup
-4. Optionally remove the filer file once all S3 API servers are migrated
+Since the env var value is run through HKDF to derive the actual key, you **cannot** simply copy the filer KEK hex string into `WEED_S3_SSE_KEY` — it would produce a different derived key.
 
-> **Important:** The env var value and the filer-stored value use the same format (64 hex characters). Use the exact same key to keep existing encrypted objects readable.
+For existing deployments with data already encrypted under the filer KEK, continue using the filer KEK (it is loaded automatically as a fallback). Set `WEED_S3_SSE_KEY` for **new deployments** that have no existing encrypted data.
 
 ## Implementation Notes