fix(docker): fail fast when prod compose secrets are unset

[Souptik96]

Summary

Running the documented prod quickstart on a fresh checkout
(docker compose -f docker-compose.prod.yml up) starts the app with empty
BETTER_AUTH_SECRET, ENCRYPTION_KEY, and INTERNAL_API_SECRET. These are passed
straight from the environment with no default (unlike POSTGRES_USER:-postgres), and
apps/sim/lib/core/config/env.ts declares all three as z.string().min(32). Because
createEnv runs with skipValidation: true, the empty values aren't rejected at boot —
they surface later (lib/core/security/encryption.ts throws on an empty ENCRYPTION_KEY,
and Better Auth can't sign sessions with an empty secret), so creating the first admin
account fails with a cleared screen and no visible error.

Fixes #5625

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation
• Other: ___________

Testing

Docker wasn't available in my environment, so I reproduced the failing layer — Compose
variable interpolation — directly on the real files using Compose's documented
${VAR:?err} / ${VAR:-default} semantics, under the issue's exact repro env
(OLLAMA_URL only):

Before (upstream/staging): BETTER_AUTH_SECRET, ENCRYPTION_KEY, INTERNAL_API_SECRET
all interpolate to empty strings (with Compose's "variable is not set" warning) → containers
start → signup fails.

After (this branch): docker compose up aborts before starting any container:

BETTER_AUTH_SECRET is required. Generate a 32-byte hex value with openssl rand -hex 32

docker-compose.prod.yml validated as parseable YAML. No TypeScript changed, so
type-check/lint/test are unaffected by this diff.

Please run the full docker compose -f docker-compose.prod.yml up e2e once in review to
confirm the container-level behavior end to end.

What changed

• docker-compose.prod.yml: guard BETTER_AUTH_SECRET, ENCRYPTION_KEY, and
  INTERNAL_API_SECRET with ${VAR:?message} in both the simstudio and realtime
  services. Compose now aborts with a message naming the missing variable and how to
  generate it. No insecure defaults are introduced — the failure is made clear and
  actionable, not papered over.
• README.md + .github/CONTRIBUTING.md (Option 2): the Docker Compose quickstart now
  generates the mandatory secrets into .env before up, matching the openssl rand -hex 32
  convention already used by the manual-setup docs.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (N/A — compose/docs-only change; no TS/test surface)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

@Souptik96 is attempting to deploy a commit to the Sim Team on Vercel.

A member of the Team first needs to authorize it.

[cursor]

PR Summary

Low Risk
Compose and documentation only; no application code changes, though missing secrets will block docker compose up until .env is set.

Overview
Prod Docker Compose now refuses to start when BETTER_AUTH_SECRET, ENCRYPTION_KEY, or INTERNAL_API_SECRET are missing, instead of booting with empty values and breaking first-account signup with no clear error.

docker-compose.prod.yml uses Compose ${VAR:?message} interpolation on those variables for both simstudio and realtime, with messages that point to openssl rand -hex 32. No insecure defaults are added.

The README and CONTRIBUTING Docker Compose quickstarts now create a root .env with those three secrets before docker compose -f docker-compose.prod.yml up, and call out that they are mandatory.

^{Reviewed by Cursor Bugbot for commit a619927. Bugbot is set up for automated code reviews on this repo. Configure here.}

[greptile-apps]

Greptile Summary

This PR makes production Compose fail early when mandatory secrets are missing. The main changes are:

• Adds required-variable guards to the Sim and realtime services.
• Generates the three required secrets in the README quickstart.
• Mirrors the secret setup in the contributor guide.

Confidence Score: 4/5

The quickstart can erase deployment settings and rotate persistent secrets when rerun in an existing checkout.

• The Compose guards consistently cover the secrets used by each service.
• Both documented setup commands replace the complete root .env.
• Secret rotation can invalidate sessions and break access to encrypted data.

README.md and .github/CONTRIBUTING.md

Important Files Changed

Filename	Overview
docker-compose.prod.yml	Adds non-empty secret guards to both production services.
README.md	Documents secret generation but replaces any existing root environment file.
.github/CONTRIBUTING.md	Mirrors the quickstart and its destructive environment-file replacement.

_{Reviews (1): Last reviewed commit: "fix(docker): fail fast when prod compose..." | Re-trigger Greptile}

[greptile-apps]

Existing Environment Is Truncated

Running this step in an existing checkout replaces the entire root .env, deleting settings such as POSTGRES_PASSWORD, TRUSTED_ORIGINS, REDIS_URL, and API keys. Rerunning it also rotates persistent auth and encryption secrets, which invalidates sessions and can make previously encrypted data unreadable; generate only missing entries or stop when .env already exists. The mirrored command in .github/CONTRIBUTING.md has the same behavior.