mirror of
https://github.com/simstudioai/sim.git
synced 2026-09-24 15:45:35 +08:00
Theodore Li
e1c3c7f6c9
* feat(secrets): ingest env secrets at container runtime instead of fanning into ECS taskdef The app/socket ECS taskdefs were ~42KB, ~93% of which was the secrets[] array: 268 pointer entries each restating the full ~78-char secret ARN, marching toward the 64KB taskdef limit and growing ~150 bytes per hosted key added. The secret blob itself is only ~18KB/268 keys. Move secret delivery to container boot: new @sim/runtime-secrets loadRuntimeSecrets() reads SIM_ENV_SECRET_ID, fetches the combined secret once, and hydrates process.env (no-clobber, no-op when unset, fail-fast). Bootstrap entrypoints for app + realtime await it before importing the real server (env-flags reads env at module load). The app bootstrap is bun-bundled in the Dockerfile builder stage since it runs outside the Next standalone bundle; realtime keeps full node_modules and runs the TS entry. Backward-compatible: with the current fan-out taskdef the loader no-ops and the app reads the injected env vars unchanged. The matching infra change (empty secrets[] + SIM_ENV_SECRET_ID) ships separately, after this image is live. * fix(runtime-secrets): address review feedback - Move the binary-secret guard outside the retry loop (sendWithRetry) so a missing SecretString throws immediately instead of burning 3 attempts + backoff. - Bound each Secrets Manager request with AbortSignal.timeout(5s) so a stalled response can't hang boot indefinitely. - Drop the redundant @aws-sdk/client-secrets-manager pin from apps/realtime; it resolves transitively via @sim/runtime-secrets. - Add a test for the non-retriable binary-secret path.
39 lines
871 B
JSON
39 lines
871 B
JSON
{
|
|
"name": "@sim/runtime-secrets",
|
|
"version": "0.1.0",
|
|
"private": true,
|
|
"sideEffects": false,
|
|
"type": "module",
|
|
"license": "Apache-2.0",
|
|
"engines": {
|
|
"bun": ">=1.2.13",
|
|
"node": ">=20.0.0"
|
|
},
|
|
"exports": {
|
|
".": {
|
|
"types": "./src/index.ts",
|
|
"default": "./src/index.ts"
|
|
}
|
|
},
|
|
"scripts": {
|
|
"type-check": "tsc --noEmit",
|
|
"lint": "biome check --write --unsafe .",
|
|
"lint:check": "biome check .",
|
|
"format": "biome format --write .",
|
|
"format:check": "biome format .",
|
|
"test": "vitest run",
|
|
"test:watch": "vitest"
|
|
},
|
|
"dependencies": {
|
|
"@aws-sdk/client-secrets-manager": "3.1032.0",
|
|
"@sim/logger": "workspace:*",
|
|
"@sim/utils": "workspace:*"
|
|
},
|
|
"devDependencies": {
|
|
"@sim/tsconfig": "workspace:*",
|
|
"@types/node": "24.2.1",
|
|
"typescript": "^5.7.3",
|
|
"vitest": "^4.1.0"
|
|
}
|
|
}
|