From a619927ad79cd7894b5eb1d5967c80e4a13491ac Mon Sep 17 00:00:00 2001 From: Souptik Chakraborty Date: Wed, 22 Jul 2026 09:17:44 +0530 Subject: [PATCH] fix(docker): fail fast when prod compose secrets are unset Running the documented prod quickstart on a fresh checkout (`docker compose -f docker-compose.prod.yml up`) starts the app with empty BETTER_AUTH_SECRET, ENCRYPTION_KEY, and INTERNAL_API_SECRET. Those are passed straight from the environment with no default (unlike POSTGRES_USER:-postgres), and apps/sim/lib/core/config/env.ts declares all three as z.string().min(32). Because createEnv runs with skipValidation: true, the empty values are not rejected at boot; they surface later - ENCRYPTION_KEY throws in lib/core/security/encryption.ts and Better Auth cannot sign sessions with an empty secret - so creating the first admin account fails with a cleared screen and no visible error. Guard the three required secrets with Compose's ${VAR:?message} syntax in both the simstudio and realtime services, so `docker compose up` aborts before starting any container with a message naming the missing variable and how to generate it (openssl rand -hex 32). No insecure defaults are introduced - the failure is made clear and actionable instead of silent. Also document the mandatory secrets in the Docker Compose quickstart in README.md and .github/CONTRIBUTING.md (Option 2), matching the openssl convention already used by the manual-setup instructions. fixes #5625 --- .github/CONTRIBUTING.md | 9 +++++++++ README.md | 10 ++++++++++ docker-compose.prod.yml | 10 +++++----- 3 files changed, 24 insertions(+), 5 deletions(-) diff --git a/.github/CONTRIBUTING.md b/.github/CONTRIBUTING.md index a41a49e628b..d5fdadea972 100644 --- a/.github/CONTRIBUTING.md +++ b/.github/CONTRIBUTING.md @@ -165,6 +165,15 @@ After running this command, open [http://localhost:3000/](http://localhost:3000/ git clone https://github.com//sim.git cd sim +# Generate the required secrets. Docker Compose reads them from this .env file. +# BETTER_AUTH_SECRET, ENCRYPTION_KEY, and INTERNAL_API_SECRET are mandatory — +# without them the containers start but creating the first account fails. +cat > .env <` to run Sim on a di ```bash git clone https://github.com/simstudioai/sim.git && cd sim + +# Generate the required secrets. Docker Compose reads them from this .env file. +cat > .env < **`BETTER_AUTH_SECRET`, `ENCRYPTION_KEY`, and `INTERNAL_API_SECRET` are mandatory.** Without them the containers start but creating the first account fails silently. Compose now refuses to start and names the missing variable if you skip this step. + Sim also supports local models via [Ollama](https://ollama.ai) and [vLLM](https://docs.vllm.ai/). See the [Docker self-hosting docs](https://docs.sim.ai/self-hosting/docker) for setup details. ### Manual Setup diff --git a/docker-compose.prod.yml b/docker-compose.prod.yml index 67266fbc780..1942bcb6679 100644 --- a/docker-compose.prod.yml +++ b/docker-compose.prod.yml @@ -17,10 +17,10 @@ services: # addition to NEXT_PUBLIC_APP_URL. Use when serving from multiple domains # (apex + www, alias hostnames, reverse-proxy IPs). Empty by default. - TRUSTED_ORIGINS=${TRUSTED_ORIGINS:-} - - BETTER_AUTH_SECRET=${BETTER_AUTH_SECRET} - - ENCRYPTION_KEY=${ENCRYPTION_KEY} + - BETTER_AUTH_SECRET=${BETTER_AUTH_SECRET:?BETTER_AUTH_SECRET is required. Generate a 32-byte hex value with openssl rand -hex 32} + - ENCRYPTION_KEY=${ENCRYPTION_KEY:?ENCRYPTION_KEY is required. Generate a 32-byte hex value with openssl rand -hex 32} - API_ENCRYPTION_KEY=${API_ENCRYPTION_KEY:-} - - INTERNAL_API_SECRET=${INTERNAL_API_SECRET} + - INTERNAL_API_SECRET=${INTERNAL_API_SECRET:?INTERNAL_API_SECRET is required. Generate a 32-byte hex value with openssl rand -hex 32} - REDIS_URL=${REDIS_URL:-} - COPILOT_API_KEY=${COPILOT_API_KEY} - SIM_AGENT_API_URL=${SIM_AGENT_API_URL} @@ -60,8 +60,8 @@ services: - DATABASE_URL=postgresql://${POSTGRES_USER:-postgres}:${POSTGRES_PASSWORD:-postgres}@db:5432/${POSTGRES_DB:-simstudio} - NEXT_PUBLIC_APP_URL=${NEXT_PUBLIC_APP_URL:-http://localhost:3000} - BETTER_AUTH_URL=${BETTER_AUTH_URL:-http://localhost:3000} - - BETTER_AUTH_SECRET=${BETTER_AUTH_SECRET} - - INTERNAL_API_SECRET=${INTERNAL_API_SECRET} + - BETTER_AUTH_SECRET=${BETTER_AUTH_SECRET:?BETTER_AUTH_SECRET is required. Generate a 32-byte hex value with openssl rand -hex 32} + - INTERNAL_API_SECRET=${INTERNAL_API_SECRET:?INTERNAL_API_SECRET is required. Generate a 32-byte hex value with openssl rand -hex 32} - REDIS_URL=${REDIS_URL:-} depends_on: db: