From 4c655b35d5c3b294652f67b6d999ee4f55bf306d Mon Sep 17 00:00:00 2001 From: Mikko Numminen Date: Fri, 24 Jul 2026 08:54:13 +0300 Subject: [PATCH 1/2] fix(compose): pass the two fail-closed secrets to the app container MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The compose stack is the one deployment path where both landmines are armed: the image runs NODE_ENV=production and Mongo IS wired. Without AUDIT_HMAC_SECRET every audit write throws post-response (entries silently lost); without TOTP_ENCRYPTION_KEY 2FA setup/verify errors at runtime (fail closed by design since b7131d8 — and before that it was broken here anyway, since compose passes no NEXTAUTH_SECRET for the legacy fallback either). Require both with the same `:?` fail-fast treatment AUTH_SECRET already gets: an immediate, actionable error at `docker compose up` beats a silent audit gap and a 2FA error weeks later. Co-Authored-By: Claude Fable 5 --- docker-compose.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/docker-compose.yml b/docker-compose.yml index 26399bb..b6b2333 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -43,6 +43,11 @@ services: DATABASE_URL: postgresql://postgres:postgres@db:5432/hrmanager MONGODB_URL: mongodb://mongo:27017/hrmanager AUTH_SECRET: "${AUTH_SECRET:?AUTH_SECRET must be set - generate with: openssl rand -base64 32}" + # Both fail closed in the production build this image runs (NODE_ENV=production): + # without AUDIT_HMAC_SECRET every audit write throws (entries silently lost — + # Mongo IS wired here), and without TOTP_ENCRYPTION_KEY 2FA setup/verify errors. + AUDIT_HMAC_SECRET: "${AUDIT_HMAC_SECRET:?AUDIT_HMAC_SECRET must be set - generate with: openssl rand -base64 32}" + TOTP_ENCRYPTION_KEY: "${TOTP_ENCRYPTION_KEY:?TOTP_ENCRYPTION_KEY must be set - generate with: openssl rand -base64 32}" AUTH_TRUST_HOST: "true" AUTH_GOOGLE_ID: ${AUTH_GOOGLE_ID:-} AUTH_GOOGLE_SECRET: ${AUTH_GOOGLE_SECRET:-} From 7836ed2ba08268d4957c554d2d7d726e294b9760 Mon Sep 17 00:00:00 2001 From: Mikko Numminen Date: Fri, 24 Jul 2026 08:54:15 +0300 Subject: [PATCH 2/2] docs(readme): compose quickstart needs the three fail-closed secrets "That's it, zero setup" predates the AUTH_SECRET requirement and now the audit/2FA keys too. Show the one-time openssl line that writes all three to .env (compose reads .env natively), and scope the Docker-ready highlight's "zero setup" claim honestly. Co-Authored-By: Claude Fable 5 --- README.md | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 26168ac..0860510 100644 --- a/README.md +++ b/README.md @@ -188,7 +188,7 @@ graph LR - **Performance at scale** — 40+ database indexes on foreign keys and frequently queried columns, N+1 query elimination (replaced eager-loaded relation counts with `_count` aggregations and `groupBy` batching), and `select` narrowing on all relation includes to avoid fetching unused columns. Performance seeding script generates 10k employees / 200 teams / 50 departments for load testing. Benchmark script measures all major query patterns with warm-up runs and P95 reporting. Full scaling analysis in [`SCALING.md`](SCALING.md) documents known scaling cliffs and recommendations for 100k+ employees. _Why document scaling limits? A production system should be honest about where it breaks — and have a plan for when it gets there._ -- **Docker-ready** — `docker compose up` starts PostgreSQL + MongoDB + the app. Migrations run automatically, demo login works out of the box. _One command, zero setup, fully working._ +- **Docker-ready** — `docker compose up` starts PostgreSQL + MongoDB + the app. Migrations run automatically, demo login works out of the box. _One command after generating three secrets into `.env` — the production build fails closed without them, by design._ --- @@ -353,10 +353,14 @@ The **CI auto-fix agent** (optional — requires paid API credits) runs a 6-stag ### Docker (recommended) ```bash +# One-time: the production build fails closed without these three secrets +printf 'AUTH_SECRET=%s\nAUDIT_HMAC_SECRET=%s\nTOTP_ENCRYPTION_KEY=%s\n' \ + "$(openssl rand -base64 32)" "$(openssl rand -base64 32)" "$(openssl rand -base64 32)" >> .env + docker compose up # starts PostgreSQL + MongoDB + app at localhost:3000 ``` -That's it. Migrations run automatically, demo login works out of the box — no OAuth setup needed. To add Google/GitHub OAuth, create a `.env` file with your credentials (see below). +That's it. Migrations run automatically, demo login works out of the box — no OAuth setup needed. To add Google/GitHub OAuth, add your credentials to the same `.env` file (see below). ### Manual setup