enigma-memory 0.1.17 → 0.1.18

package/deploy/SIMULATION.md

@@ -38,12 +38,15 @@ names so that containers can resolve them locally when needed.
    node scripts/simulate-production-env.mjs
    ```
 
-   Files are written to `deploy/secrets-simulation/` (gitignored).
+   By default files are written outside the repo to
+   `~/.enigma/simulation-secrets`. Use `--secrets-dir <absolute-path>` for a
+   different location; paths inside the repository are rejected.
 
-2. Start the simulation:
+2. Start the simulation with the generated secrets path:
 
    ```bash
-   docker compose -f deploy/docker-compose.local-production-simulation.yml up --build -d
+   export ENIGMA_SIM_SECRETS_DIR="$HOME/.enigma/simulation-secrets"
+   docker compose -f deploy/docker-compose.local-production-simulation.yml --env-file "$ENIGMA_SIM_SECRETS_DIR/simulation.env" up --build -d
    ```
 
 3. Wait for the backend to become ready:
@@ -64,13 +67,13 @@ names so that containers can resolve them locally when needed.
 ## Stop
 
 ```bash
-docker compose -f deploy/docker-compose.local-production-simulation.yml down
+docker compose -f deploy/docker-compose.local-production-simulation.yml --env-file "$ENIGMA_SIM_SECRETS_DIR/simulation.env" down
 ```
 
 To also remove the Postgres volume and mock event data:
 
 ```bash
-docker compose -f deploy/docker-compose.local-production-simulation.yml down -v
+docker compose -f deploy/docker-compose.local-production-simulation.yml --env-file "$ENIGMA_SIM_SECRETS_DIR/simulation.env" down -v
 ```
 
 ## Ports and routes
@@ -86,11 +89,12 @@ docker compose -f deploy/docker-compose.local-production-simulation.yml down -v
 ## Verify secret files
 
 ```bash
+export ENIGMA_SIM_SECRETS_DIR="$HOME/.enigma/simulation-secrets"
 node scripts/simulate-production-env.mjs --check
 ```
 
-This reports whether all required files in `deploy/secrets-simulation/` exist
-and are non-empty.
+This reports whether all required files in the configured simulation secrets
+ directory exist and are non-empty.
 
 ## Simulation-only behavior
 
@@ -144,5 +148,6 @@ Hosted readiness remains blocked until the production commands above observe
 public HTTPS relay/gateway probes, all required hosted refs, and operator
 acceptance `go` for the exact target environment.
 
-Never commit `deploy/secrets-simulation/` or `*.pem` files. Both are
-`.gitignore`d.
+Simulation secrets, TLS keys, and bearer-token digests are kept outside the
+repository. Never commit the simulation secrets directory, `*.pem` files, or
+`simulation.env`. They are generated locally and must not be added to the repo.

package/deploy/docker-compose.local-production-simulation.yml

@@ -4,6 +4,12 @@
 # SIEM. It is not a production deployment and does not prove hosted/BYOC
 # readiness.
 #
+# REQUIRED ENVIRONMENT VARIABLE:
+#   ENIGMA_SIM_SECRETS_DIR must point to the absolute path of the simulation
+#   secrets directory. Generate it with:
+#     node scripts/simulate-production-env.mjs
+#   which writes the default to ~/.enigma/simulation-secrets.
+#
 # LOCAL DNS NOTE: From the host, map sim.enigmamemory.com (and optional
 # relay.sim.enigmamemory.com and gateway.sim.enigmamemory.com) to 127.0.0.1
 # via /etc/hosts or local DNS. This lets curl -k reach the tls-proxy container
@@ -37,7 +43,7 @@ services:
       KMS_KEY_ID: "local-simulation-kms-key"
     volumes:
       - ./kms-mock.mjs:/app/deploy/kms-mock.mjs:ro
-      - ./secrets-simulation:/app/secrets-simulation:ro
+      - ${ENIGMA_SIM_SECRETS_DIR}:/app/secrets-simulation:ro
       - kms-data:/data
     healthcheck:
       test: ["CMD-SHELL", "node -e \"fetch('http://127.0.0.1:3000/healthz').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))\""]
@@ -142,6 +148,8 @@ services:
       - backup_target_uri
       - operator_acceptance_evidence_uri
     environment:
+      ENIGMA_GATEWAY_ADMIN_AUTH_BEARER_SHA256: ${ENIGMA_GATEWAY_ADMIN_AUTH_BEARER_SHA256:-operator-required-admin-bearer-sha256}
+      ENIGMA_GATEWAY_DATA_PLANE_AUTH_BEARER_SHA256: ${ENIGMA_GATEWAY_DATA_PLANE_AUTH_BEARER_SHA256:-operator-required-data-plane-bearer-sha256}
       NODE_ENV: production
       ENIGMA_BACKEND_MODE: production
       ENIGMA_REQUIRE_EXTERNAL_STORAGE: "true"
@@ -172,8 +180,6 @@ services:
       ENIGMA_INCIDENT_DRILL_REF: local-simulation-incident-drill-ref
       ENIGMA_BACKUP_RESTORE_DRILL_REF: local-simulation-backup-restore-drill-ref
       ENIGMA_OPERATOR_ACCEPTANCE_DECISION: go
-      ENIGMA_GATEWAY_ADMIN_AUTH_BEARER_SHA256: sha256:6655800954551a39fc1cde811dbe44366ab67b369170b16f4f7c421b5b695870
-      ENIGMA_GATEWAY_DATA_PLANE_AUTH_BEARER_SHA256: sha256:21030e3332a199d4b729cd5a8035fdf43f0abdb541af9ee9917639ff67abdecb
       ENIGMA_GATEWAY_SIGNING_KEY_FILE: /run/secrets/gateway_signing_key
       ENIGMA_KMS_KEY_REF_FILE: /run/secrets/kms_key_ref
       ENIGMA_SIEM_EXPORT_ENDPOINT_FILE: /run/secrets/siem_export_endpoint
@@ -203,8 +209,8 @@ services:
       - "127.0.0.1:${ENIGMA_SIM_RELAY_PORT:-8443}:8443"
       - "127.0.0.1:${ENIGMA_SIM_GATEWAY_PORT:-9443}:9443"
     volumes:
-      - ./secrets-simulation/tls.crt:/etc/nginx/ssl/tls.crt:ro
-      - ./secrets-simulation/tls.key:/etc/nginx/ssl/tls.key:ro
+      - ${ENIGMA_SIM_SECRETS_DIR}/tls.crt:/etc/nginx/ssl/tls.crt:ro
+      - ${ENIGMA_SIM_SECRETS_DIR}/tls.key:/etc/nginx/ssl/tls.key:ro
       - ./nginx.local-production-simulation.conf:/etc/nginx/conf.d/default.conf:ro
     extra_hosts:
       - "sim.enigmamemory.com:127.0.0.1"
@@ -219,19 +225,19 @@ services:
 
 secrets:
   relay_signing_key:
-    file: ./secrets-simulation/relay-signing-key
+    file: ${ENIGMA_SIM_SECRETS_DIR}/relay-signing-key
   gateway_signing_key:
-    file: ./secrets-simulation/gateway-signing-key
+    file: ${ENIGMA_SIM_SECRETS_DIR}/gateway-signing-key
   external_storage_dsn:
-    file: ./secrets-simulation/external-storage-dsn
+    file: ${ENIGMA_SIM_SECRETS_DIR}/external-storage-dsn
   kms_key_ref:
-    file: ./secrets-simulation/kms-key-ref
+    file: ${ENIGMA_SIM_SECRETS_DIR}/kms-key-ref
   backup_target_uri:
-    file: ./secrets-simulation/backup-target-uri
+    file: ${ENIGMA_SIM_SECRETS_DIR}/backup-target-uri
   siem_export_endpoint:
-    file: ./secrets-simulation/siem-export-endpoint
+    file: ${ENIGMA_SIM_SECRETS_DIR}/siem-export-endpoint
   operator_acceptance_evidence_uri:
-    file: ./secrets-simulation/operator-acceptance-evidence-uri
+    file: ${ENIGMA_SIM_SECRETS_DIR}/operator-acceptance-evidence-uri
 
 volumes:
   pgdata: