René's URL Explorer Experiment

Title: fix(docker): require auth secrets in prod and Ollama Compose files by waleedlatif1 · Pull Request #5806 · simstudioai/sim · GitHub

Open Graph Title: fix(docker): require auth secrets in prod and Ollama Compose files by waleedlatif1 · Pull Request #5806 · simstudioai/sim

X Title: fix(docker): require auth secrets in prod and Ollama Compose files by waleedlatif1 · Pull Request #5806 · simstudioai/sim

Description: Summary Builds on #5801 (included as the first commit) and closes the remaining gap in that fix: the same first-user-signup failure still exists in docker-compose.ollama.yml, which many self-hosters use because it's the "try Sim with local models" path. Root cause (the part #5801 didn't cover) docker-compose.ollama.yml fell back to broken secret defaults: BETTER_AUTH_SECRET=${BETTER_AUTH_SECRET:-sim_auth_secret_$(openssl rand -hex 16)} and ENCRYPTION_KEY=${ENCRYPTION_KEY:-$(openssl rand -hex 32)} — Docker Compose does not perform $(...) command substitution, so these resolve to the literal strings, i.e. a fixed, shared, weak secret across every install. Worse, the ENCRYPTION_KEY literal ($(openssl rand -hex 32), 22 chars) is under the 32-char minimum the app enforces (z.string().min(32)), so it fails env validation. INTERNAL_API_SECRET — required (z.string().min(32)) by both the app (apps/sim/lib/core/config/env.ts) and realtime (apps/realtime/src/env.ts) — was not passed at all, so the Ollama quick start couldn't sign up the first admin, exactly like the prod bug in #5625. Changes Mirror the prod hardening in docker-compose.ollama.yml: require BETTER_AUTH_SECRET, ENCRYPTION_KEY, and INTERNAL_API_SECRET via mandatory ${VAR:?...} interpolation, and add INTERNAL_API_SECRET to both simstudio and realtime. Extend the regression test to assert the mandatory-secret interpolation for both docker-compose.prod.yml and docker-compose.ollama.yml. Note the .env prerequisite in the Ollama section of the docs (en/de/es/fr/ja/zh) and CONTRIBUTING. Validation vitest run lib/core/config/docker-compose-secrets.test.ts — 10 passed (5 prod + 5 ollama; the test parses the real Compose files). biome check on the test file — passed. Both Compose files parse as valid YAML (loaded by the test via js-yaml). Credit First commit is @brainx's original #5801. This PR supersedes it — merging this lands both fixes together. Fixes #5625

Open Graph Description: Summary Builds on #5801 (included as the first commit) and closes the remaining gap in that fix: the same first-user-signup failure still exists in docker-compose.ollama.yml, which many self-hoster...

X Description: Summary Builds on #5801 (included as the first commit) and closes the remaining gap in that fix: the same first-user-signup failure still exists in docker-compose.ollama.yml, which many self-hoster...

Opengraph URL: https://github.com/simstudioai/sim/pull/5806

X: @github

direct link

Domain: github.com

Links:

Viewport: width=device-width