fix(docker): fail fast when prod compose secrets are unset#5836
fix(docker): fail fast when prod compose secrets are unset#5836Souptik96 wants to merge 1 commit into
Conversation
Running the documented prod quickstart on a fresh checkout
(`docker compose -f docker-compose.prod.yml up`) starts the app with empty
BETTER_AUTH_SECRET, ENCRYPTION_KEY, and INTERNAL_API_SECRET. Those are passed
straight from the environment with no default (unlike POSTGRES_USER:-postgres),
and apps/sim/lib/core/config/env.ts declares all three as z.string().min(32).
Because createEnv runs with skipValidation: true, the empty values are not
rejected at boot; they surface later - ENCRYPTION_KEY throws in
lib/core/security/encryption.ts and Better Auth cannot sign sessions with an
empty secret - so creating the first admin account fails with a cleared screen
and no visible error.
Guard the three required secrets with Compose's ${VAR:?message} syntax in both
the simstudio and realtime services, so `docker compose up` aborts before
starting any container with a message naming the missing variable and how to
generate it (openssl rand -hex 32). No insecure defaults are introduced - the
failure is made clear and actionable instead of silent.
Also document the mandatory secrets in the Docker Compose quickstart in
README.md and .github/CONTRIBUTING.md (Option 2), matching the openssl
convention already used by the manual-setup instructions.
fixes simstudioai#5625
|
@Souptik96 is attempting to deploy a commit to the Sim Team on Vercel. A member of the Team first needs to authorize it. |
PR SummaryLow Risk Overview
The README and CONTRIBUTING Docker Compose quickstarts now create a root Reviewed by Cursor Bugbot for commit a619927. Bugbot is set up for automated code reviews on this repo. Configure here. |
Greptile SummaryThis PR makes production Compose fail early when mandatory secrets are missing. The main changes are:
Confidence Score: 4/5The quickstart can erase deployment settings and rotate persistent secrets when rerun in an existing checkout.
README.md and .github/CONTRIBUTING.md Important Files Changed
Reviews (1): Last reviewed commit: "fix(docker): fail fast when prod compose..." | Re-trigger Greptile |
| git clone https://github.com/simstudioai/sim.git && cd sim | ||
|
|
||
| # Generate the required secrets. Docker Compose reads them from this .env file. | ||
| cat > .env <<EOF |
There was a problem hiding this comment.
Running this step in an existing checkout replaces the entire root .env, deleting settings such as POSTGRES_PASSWORD, TRUSTED_ORIGINS, REDIS_URL, and API keys. Rerunning it also rotates persistent auth and encryption secrets, which invalidates sessions and can make previously encrypted data unreadable; generate only missing entries or stop when .env already exists. The mirrored command in .github/CONTRIBUTING.md has the same behavior.
Summary
Running the documented prod quickstart on a fresh checkout
(
docker compose -f docker-compose.prod.yml up) starts the app with emptyBETTER_AUTH_SECRET,ENCRYPTION_KEY, andINTERNAL_API_SECRET. These are passedstraight from the environment with no default (unlike
POSTGRES_USER:-postgres), andapps/sim/lib/core/config/env.tsdeclares all three asz.string().min(32). BecausecreateEnvruns withskipValidation: true, the empty values aren't rejected at boot —they surface later (
lib/core/security/encryption.tsthrows on an emptyENCRYPTION_KEY,and Better Auth can't sign sessions with an empty secret), so creating the first admin
account fails with a cleared screen and no visible error.
Fixes #5625
Type of Change
Testing
Docker wasn't available in my environment, so I reproduced the failing layer — Compose
variable interpolation — directly on the real files using Compose's documented
${VAR:?err}/${VAR:-default}semantics, under the issue's exact repro env(
OLLAMA_URLonly):Before (upstream/staging):
BETTER_AUTH_SECRET,ENCRYPTION_KEY,INTERNAL_API_SECRETall interpolate to empty strings (with Compose's "variable is not set" warning) → containers
start → signup fails.
After (this branch):
docker compose upaborts before starting any container:docker-compose.prod.ymlvalidated as parseable YAML. No TypeScript changed, sotype-check/lint/test are unaffected by this diff.
Please run the full
docker compose -f docker-compose.prod.yml upe2e once in review toconfirm the container-level behavior end to end.
What changed
docker-compose.prod.yml: guardBETTER_AUTH_SECRET,ENCRYPTION_KEY, andINTERNAL_API_SECRETwith${VAR:?message}in both thesimstudioandrealtimeservices. Compose now aborts with a message naming the missing variable and how to
generate it. No insecure defaults are introduced — the failure is made clear and
actionable, not papered over.
README.md+.github/CONTRIBUTING.md(Option 2): the Docker Compose quickstart nowgenerates the mandatory secrets into
.envbeforeup, matching theopenssl rand -hex 32convention already used by the manual-setup docs.
Checklist