enigma-memory 0.1.17 → 0.1.22

package/deploy/SIMULATION.md

@@ -38,12 +38,15 @@ names so that containers can resolve them locally when needed.
    node scripts/simulate-production-env.mjs
    ```
 
-   Files are written to `deploy/secrets-simulation/` (gitignored).
+   By default files are written outside the repo to
+   `~/.enigma/simulation-secrets`. Use `--secrets-dir <absolute-path>` for a
+   different location; paths inside the repository are rejected.
 
-2. Start the simulation:
+2. Start the simulation with the generated secrets path:
 
    ```bash
-   docker compose -f deploy/docker-compose.local-production-simulation.yml up --build -d
+   export ENIGMA_SIM_SECRETS_DIR="$HOME/.enigma/simulation-secrets"
+   docker compose -f deploy/docker-compose.local-production-simulation.yml --env-file "$ENIGMA_SIM_SECRETS_DIR/simulation.env" up --build -d
    ```
 
 3. Wait for the backend to become ready:
@@ -64,13 +67,13 @@ names so that containers can resolve them locally when needed.
 ## Stop
 
 ```bash
-docker compose -f deploy/docker-compose.local-production-simulation.yml down
+docker compose -f deploy/docker-compose.local-production-simulation.yml --env-file "$ENIGMA_SIM_SECRETS_DIR/simulation.env" down
 ```
 
 To also remove the Postgres volume and mock event data:
 
 ```bash
-docker compose -f deploy/docker-compose.local-production-simulation.yml down -v
+docker compose -f deploy/docker-compose.local-production-simulation.yml --env-file "$ENIGMA_SIM_SECRETS_DIR/simulation.env" down -v
 ```
 
 ## Ports and routes
@@ -86,11 +89,12 @@ docker compose -f deploy/docker-compose.local-production-simulation.yml down -v
 ## Verify secret files
 
 ```bash
+export ENIGMA_SIM_SECRETS_DIR="$HOME/.enigma/simulation-secrets"
 node scripts/simulate-production-env.mjs --check
 ```
 
-This reports whether all required files in `deploy/secrets-simulation/` exist
-and are non-empty.
+This reports whether all required files in the configured simulation secrets
+ directory exist and are non-empty.
 
 ## Simulation-only behavior
 
@@ -144,5 +148,6 @@ Hosted readiness remains blocked until the production commands above observe
 public HTTPS relay/gateway probes, all required hosted refs, and operator
 acceptance `go` for the exact target environment.
 
-Never commit `deploy/secrets-simulation/` or `*.pem` files. Both are
-`.gitignore`d.
+Simulation secrets, TLS keys, and bearer-token digests are kept outside the
+repository. Never commit the simulation secrets directory, `*.pem` files, or
+`simulation.env`. They are generated locally and must not be added to the repo.

package/deploy/docker-compose.local-production-simulation.yml

@@ -4,6 +4,12 @@
 # SIEM. It is not a production deployment and does not prove hosted/BYOC
 # readiness.
 #
+# REQUIRED ENVIRONMENT VARIABLE:
+#   ENIGMA_SIM_SECRETS_DIR must point to the absolute path of the simulation
+#   secrets directory. Generate it with:
+#     node scripts/simulate-production-env.mjs
+#   which writes the default to ~/.enigma/simulation-secrets.
+#
 # LOCAL DNS NOTE: From the host, map sim.enigmamemory.com (and optional
 # relay.sim.enigmamemory.com and gateway.sim.enigmamemory.com) to 127.0.0.1
 # via /etc/hosts or local DNS. This lets curl -k reach the tls-proxy container
@@ -37,7 +43,7 @@ services:
       KMS_KEY_ID: "local-simulation-kms-key"
     volumes:
       - ./kms-mock.mjs:/app/deploy/kms-mock.mjs:ro
-      - ./secrets-simulation:/app/secrets-simulation:ro
+      - ${ENIGMA_SIM_SECRETS_DIR}:/app/secrets-simulation:ro
       - kms-data:/data
     healthcheck:
       test: ["CMD-SHELL", "node -e \"fetch('http://127.0.0.1:3000/healthz').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))\""]
@@ -64,6 +70,13 @@ services:
       start_period: 3s
     restart: unless-stopped
 
+  simulation-state-init:
+    image: alpine:3.22
+    command: ["sh", "-c", "chown -R 1000:1000 /simulation-state && chmod 700 /simulation-state"]
+    volumes:
+      - simulation-state:/simulation-state
+    restart: "no"
+
   relay:
     build:
       context: ..
@@ -79,6 +92,10 @@ services:
       - operator_acceptance_evidence_uri
     environment:
       NODE_ENV: production
+      # Guarded local-only serve module; never use this module in hosted/BYOC manifests.
+      ENIGMA_LOCAL_PRODUCTION_SIMULATION: "true"
+      ENIGMA_RELAY_SERVE_MODULE: /app/scripts/local-production-simulation-serve.mjs
+      ENIGMA_SIMULATION_STATE_DIR: /simulation-state
       ENIGMA_BACKEND_MODE: production
       ENIGMA_REQUIRE_EXTERNAL_STORAGE: "true"
       ENIGMA_REQUIRE_EXTERNAL_KMS: "true"
@@ -90,7 +107,9 @@ services:
       ENIGMA_RELAY_RUNTIME_AUTH_REF: local-simulation-relay-runtime-auth-ref
       ENIGMA_RELAY_MONITORING_REF: local-simulation-relay-monitoring-ref
       ENIGMA_SIEM_REF: local-simulation-siem-ref
+      ENIGMA_RELAY_STORAGE_REF: local-simulation-relay-storage-ref
       ENIGMA_BACKUP_TARGET_URI_FILE: /run/secrets/backup_target_uri
+      ENIGMA_BACKUP_TARGET_REF: local-simulation-backup-target-ref
       ENIGMA_NETWORK_ACCESS_POLICY_REF: local-simulation-network-access-policy-ref
       ENIGMA_KMS_CUSTODY_REF: local-simulation-kms-custody-ref
       ENIGMA_KMS_KEY_REF: local-simulation-kms-key-ref
@@ -109,9 +128,15 @@ services:
       ENIGMA_EXTERNAL_STORAGE_DSN_FILE: /run/secrets/external_storage_dsn
       ENIGMA_KMS_KEY_REF_FILE: /run/secrets/kms_key_ref
       ENIGMA_OPERATOR_ACCEPTANCE_EVIDENCE_URI_FILE: /run/secrets/operator_acceptance_evidence_uri
+    volumes:
+      - simulation-state:/simulation-state
     depends_on:
       postgres:
         condition: service_healthy
+      kms-mock:
+        condition: service_healthy
+      simulation-state-init:
+        condition: service_completed_successfully
     read_only: true
     user: "1000:1000"
     cap_drop: ["ALL"]
@@ -142,7 +167,15 @@ services:
       - backup_target_uri
       - operator_acceptance_evidence_uri
     environment:
+      ENIGMA_GATEWAY_ADMIN_AUTH_BEARER_SHA256: ${ENIGMA_GATEWAY_ADMIN_AUTH_BEARER_SHA256:-operator-required-admin-bearer-sha256}
+      ENIGMA_GATEWAY_DATA_PLANE_AUTH_BEARER_SHA256: ${ENIGMA_GATEWAY_DATA_PLANE_AUTH_BEARER_SHA256:-operator-required-data-plane-bearer-sha256}
       NODE_ENV: production
+      # Guarded local-only serve module; never use this module in hosted/BYOC manifests.
+      ENIGMA_LOCAL_PRODUCTION_SIMULATION: "true"
+      ENIGMA_GATEWAY_SERVE_MODULE: /app/scripts/local-production-simulation-serve.mjs
+      ENIGMA_SIMULATION_STATE_DIR: /simulation-state
+      ENIGMA_SIMULATION_KMS_KEY_PATH: /simulation-kms/kms-key-ref.json
+      ENIGMA_SIMULATION_SIEM_URL: http://siem-mock:3000/events
       ENIGMA_BACKEND_MODE: production
       ENIGMA_REQUIRE_EXTERNAL_STORAGE: "true"
       ENIGMA_REQUIRE_EXTERNAL_KMS: "true"
@@ -158,6 +191,7 @@ services:
       ENIGMA_GATEWAY_ADMIN_AUTH_REF: local-simulation-gateway-admin-auth-ref
       ENIGMA_GATEWAY_DATA_PLANE_AUTH_REF: local-simulation-gateway-data-plane-auth-ref
       ENIGMA_BACKUP_TARGET_URI_FILE: /run/secrets/backup_target_uri
+      ENIGMA_BACKUP_TARGET_REF: local-simulation-backup-target-ref
       ENIGMA_NETWORK_ACCESS_POLICY_REF: local-simulation-network-access-policy-ref
       ENIGMA_KMS_CUSTODY_REF: local-simulation-kms-custody-ref
       ENIGMA_KMS_KEY_REF: local-simulation-kms-key-ref
@@ -172,16 +206,23 @@ services:
       ENIGMA_INCIDENT_DRILL_REF: local-simulation-incident-drill-ref
       ENIGMA_BACKUP_RESTORE_DRILL_REF: local-simulation-backup-restore-drill-ref
       ENIGMA_OPERATOR_ACCEPTANCE_DECISION: go
-      ENIGMA_GATEWAY_ADMIN_AUTH_BEARER_SHA256: sha256:6655800954551a39fc1cde811dbe44366ab67b369170b16f4f7c421b5b695870
-      ENIGMA_GATEWAY_DATA_PLANE_AUTH_BEARER_SHA256: sha256:21030e3332a199d4b729cd5a8035fdf43f0abdb541af9ee9917639ff67abdecb
       ENIGMA_GATEWAY_SIGNING_KEY_FILE: /run/secrets/gateway_signing_key
       ENIGMA_KMS_KEY_REF_FILE: /run/secrets/kms_key_ref
       ENIGMA_SIEM_EXPORT_ENDPOINT_FILE: /run/secrets/siem_export_endpoint
       ENIGMA_EXTERNAL_STORAGE_DSN_FILE: /run/secrets/external_storage_dsn
       ENIGMA_OPERATOR_ACCEPTANCE_EVIDENCE_URI_FILE: /run/secrets/operator_acceptance_evidence_uri
+    volumes:
+      - simulation-state:/simulation-state
+      - kms-data:/simulation-kms:ro
     depends_on:
       postgres:
         condition: service_healthy
+      kms-mock:
+        condition: service_healthy
+      siem-mock:
+        condition: service_healthy
+      simulation-state-init:
+        condition: service_completed_successfully
     read_only: true
     user: "1000:1000"
     cap_drop: ["ALL"]
@@ -203,8 +244,8 @@ services:
       - "127.0.0.1:${ENIGMA_SIM_RELAY_PORT:-8443}:8443"
       - "127.0.0.1:${ENIGMA_SIM_GATEWAY_PORT:-9443}:9443"
     volumes:
-      - ./secrets-simulation/tls.crt:/etc/nginx/ssl/tls.crt:ro
-      - ./secrets-simulation/tls.key:/etc/nginx/ssl/tls.key:ro
+      - ${ENIGMA_SIM_SECRETS_DIR}/tls.crt:/etc/nginx/ssl/tls.crt:ro
+      - ${ENIGMA_SIM_SECRETS_DIR}/tls.key:/etc/nginx/ssl/tls.key:ro
       - ./nginx.local-production-simulation.conf:/etc/nginx/conf.d/default.conf:ro
     extra_hosts:
       - "sim.enigmamemory.com:127.0.0.1"
@@ -219,21 +260,22 @@ services:
 
 secrets:
   relay_signing_key:
-    file: ./secrets-simulation/relay-signing-key
+    file: ${ENIGMA_SIM_SECRETS_DIR}/relay-signing-key
   gateway_signing_key:
-    file: ./secrets-simulation/gateway-signing-key
+    file: ${ENIGMA_SIM_SECRETS_DIR}/gateway-signing-key
   external_storage_dsn:
-    file: ./secrets-simulation/external-storage-dsn
+    file: ${ENIGMA_SIM_SECRETS_DIR}/external-storage-dsn
   kms_key_ref:
-    file: ./secrets-simulation/kms-key-ref
+    file: ${ENIGMA_SIM_SECRETS_DIR}/kms-key-ref
   backup_target_uri:
-    file: ./secrets-simulation/backup-target-uri
+    file: ${ENIGMA_SIM_SECRETS_DIR}/backup-target-uri
   siem_export_endpoint:
-    file: ./secrets-simulation/siem-export-endpoint
+    file: ${ENIGMA_SIM_SECRETS_DIR}/siem-export-endpoint
   operator_acceptance_evidence_uri:
-    file: ./secrets-simulation/operator-acceptance-evidence-uri
+    file: ${ENIGMA_SIM_SECRETS_DIR}/operator-acceptance-evidence-uri
 
 volumes:
   pgdata:
   kms-data:
   siem-data:
+  simulation-state: