fix(docker): require persistent auth secrets

[brainx]

Summary

• require persistent auth and encryption secrets before production Compose starts
• document protected, no-clobber secret setup across the README, contributor guide, and localized Docker guides
• add a regression test covering the app and realtime secret interpolation

Root cause

The documented quick start launched production Compose without BETTER_AUTH_SECRET, ENCRYPTION_KEY, or INTERNAL_API_SECRET. The app root could pass the health check, but Better Auth rejected signup at request time because it fell back to its forbidden production default secret.

Fixes #5625

Validation

• node ../../node_modules/vitest/vitest.mjs run lib/core/config/docker-compose-secrets.test.ts 'app/api/auth/[...all]/route.test.ts' - 9 passed
• node node_modules/@biomejs/biome/bin/biome check apps/sim/lib/core/config/docker-compose-secrets.test.ts - passed
• changed Docker MDX guides compiled with @mdx-js/mdx
• README quick-start shell block parsed under sh, bash, and zsh
• git diff --check - passed

Limitations

• Full app type-check currently stops on the unrelated existing responseErrorMessage error in apps/sim/tools/github/create_pr_review.ts:261.
• Docker Compose is unavailable in this environment, so the modified Compose file was not executed with docker compose config or docker compose up. The original auth failure and valid-secret control were reproduced against the official images using Apple Container.

[vercel]

@brainx is attempting to deploy a commit to the Sim Team on Vercel.

A member of the Team first needs to authorize it.

[cursor]

PR Summary

Medium Risk
Changes auth/encryption bootstrap for self-hosted production and make missing .env secrets a hard startup failure; existing deployments that already set these vars are unaffected, but anyone relying on implicit defaults must generate secrets first.

Overview
Production Docker Compose now uses ${VAR:?...} for BETTER_AUTH_SECRET, ENCRYPTION_KEY, and INTERNAL_API_SECRET on simstudio and for auth/internal secrets on realtime, so docker compose up stops with a clear error instead of starting with missing values and breaking signup at runtime.

Self-hosting docs (README, CONTRIBUTING, and localized Docker guides) replace the old inline secret snippet with a one-time, no-clobber shell block that writes a gitignored .env, plus warnings to back it up separately and not rotate encryption or auth secrets on existing installs. Production setup steps now assume those quick-start secrets and only add public URL vars.

A Vitest file asserts the compose YAML keeps the required :? interpolation for the app and realtime services.

^{Reviewed by Cursor Bugbot for commit 7c24159. Bugbot is set up for automated code reviews on this repo. Configure here.}

[greptile-apps]

Greptile Summary

This PR makes production Docker Compose fail fast when persistent secrets are missing. The main changes are:

• Requires authentication and encryption secrets for the app and realtime services.
• Documents protected, persistent .env generation across Docker setup guides.
• Adds tests for required secret interpolation in the production Compose file.

Confidence Score: 5/5

This looks safe to merge.

• No blocking issues found in the changed code.
• Required Compose variables match the app and realtime consumers.
• Tests cover all newly required service-variable pairs.

Important Files Changed

Filename	Overview
docker-compose.prod.yml	Requires the app and realtime secrets used by their production runtime paths.
apps/sim/lib/core/config/docker-compose-secrets.test.ts	Checks every service-variable pair made mandatory by the Compose change.
README.md	Adds protected secret generation and persistence guidance to the quick start.
apps/docs/content/docs/en/platform/self-hosting/docker.mdx	Updates Docker setup guidance to preserve secrets across restarts and backups.

_{Reviews (1): Last reviewed commit: "fix(docker): require persistent auth sec..." | Re-trigger Greptile}