Waleed
9cd2e7f5fd
Every secret was held to the 64-hex AES form, but only the encryption keys need it — BETTER_AUTH_SECRET and INTERNAL_API_SECRET are HMAC secrets that just need 32 characters. An operator-chosen passphrase was silently replaced on the next run, invalidating every sign-in. Reject the repository's published example values at any length: they are longer than the 32-character minimum and would otherwise pass as real. Back the file up and say so when replacing a value that was already there, rather than reporting it as a routine generation. Generate and pass API_ENCRYPTION_KEY, without which the app stores workspace API keys in plain text; values predating it lack the encrypted shape and are still read as-is. Resolve secrets before any container starts, so a filesystem problem reports a usable message instead of leaving a half-started stack behind.
Sim CLI
Sim CLI allows you to run Sim using Docker with a single command.
Installation
To install the Sim CLI globally, use:
npm install -g simstudio
Usage
To start Sim, simply run:
simstudio
Options
-p, --port <port>: Specify the port to run Sim on (default: 3000).--no-pull: Skip pulling the latest Docker images.
Requirements
- Docker must be installed and running on your machine.
Data and secrets
Everything lives under ~/.simstudio:
data/postgres— the database volume.secrets.env— secrets generated for this install on first run, then reused.
Keep secrets.env. ENCRYPTION_KEY and API_ENCRYPTION_KEY decrypt data already stored in the
database, so replacing them leaves that data unreadable. Back the file up alongside data/.
You can supply your own values by editing it. The format is KEY=value, one per line, with #
for comments — quotes are not interpreted, so leave them off.
| Key | Requirement |
|---|---|
ENCRYPTION_KEY, API_ENCRYPTION_KEY |
exactly 64 hex characters (openssl rand -hex 32) |
BETTER_AUTH_SECRET, INTERNAL_API_SECRET |
at least 32 characters, otherwise free-form |
A value that does not meet its requirement is regenerated on the next run. When that replaces
something you had set, the CLI says so and copies the previous file to secrets.env.bak-<time>.
Contributing
Contributions are welcome! Please open an issue or submit a pull request.
License
This project is licensed under the Apache-2.0 License.