From 483e4e6a701c60952bbf2ea297d923cd8be07c3e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Acharn=C3=A9?= Date: Fri, 21 Aug 2026 02:16:15 +0700 Subject: [PATCH] fix: pass required IAM keys to Lightsail API --- infrastructure/lightsail/.env.example | 2 ++ infrastructure/lightsail/compose.pilot.yml | 5 +++++ tools/repo-cli/test/lightsail-deployment.test.mjs | 7 +++++++ 3 files changed, 14 insertions(+) diff --git a/infrastructure/lightsail/.env.example b/infrastructure/lightsail/.env.example index 1a62b23e..f3ba8552 100644 --- a/infrastructure/lightsail/.env.example +++ b/infrastructure/lightsail/.env.example @@ -53,6 +53,8 @@ WEB_IMAGE=ghcr.io/OWNER/databreeze-web:CHANGE_ME_COMMIT_SHA # Generate each value as 32 random bytes encoded with base64url (43 characters). DATABREEZE_IAM_EMAIL_VERIFICATION_DIGEST_KEY=CHANGE_ME_43_CHAR_BASE64URL_KEY DATABREEZE_IAM_EMAIL_VERIFICATION_ENVELOPE_KEY=CHANGE_ME_43_CHAR_BASE64URL_KEY +DATABREEZE_IAM_INVITATION_DIGEST_KEY=CHANGE_ME_43_CHAR_BASE64URL_KEY DATABREEZE_IAM_REGISTRATION_ADMISSION_KEY=CHANGE_ME_43_CHAR_BASE64URL_KEY DATABREEZE_IAM_RECOVERY_DIGEST_KEY=CHANGE_ME_43_CHAR_BASE64URL_KEY DATABREEZE_SERVICE_ACCOUNT_SECRET_ENVELOPE_KEY=CHANGE_ME_43_CHAR_BASE64URL_KEY +DATABREEZE_IAE_WORKER_CAPABILITY_SIGNING_KEY=CHANGE_ME_43_CHAR_BASE64URL_KEY diff --git a/infrastructure/lightsail/compose.pilot.yml b/infrastructure/lightsail/compose.pilot.yml index 4336df11..bb6040f1 100644 --- a/infrastructure/lightsail/compose.pilot.yml +++ b/infrastructure/lightsail/compose.pilot.yml @@ -179,6 +179,8 @@ services: DATABREEZE_IAM_EMAIL_VERIFICATION_ENVELOPE_KEY: ${DATABREEZE_IAM_EMAIL_VERIFICATION_ENVELOPE_KEY:?DATABREEZE_IAM_EMAIL_VERIFICATION_ENVELOPE_KEY must be set} + DATABREEZE_IAM_INVITATION_DIGEST_KEY: + ${DATABREEZE_IAM_INVITATION_DIGEST_KEY:?DATABREEZE_IAM_INVITATION_DIGEST_KEY must be set} DATABREEZE_IAM_REGISTRATION_ADMISSION_KEY: ${DATABREEZE_IAM_REGISTRATION_ADMISSION_KEY:?DATABREEZE_IAM_REGISTRATION_ADMISSION_KEY must be set} @@ -187,6 +189,9 @@ services: DATABREEZE_SERVICE_ACCOUNT_SECRET_ENVELOPE_KEY: ${DATABREEZE_SERVICE_ACCOUNT_SECRET_ENVELOPE_KEY:?DATABREEZE_SERVICE_ACCOUNT_SECRET_ENVELOPE_KEY must be set} + DATABREEZE_IAE_WORKER_CAPABILITY_SIGNING_KEY: + ${DATABREEZE_IAE_WORKER_CAPABILITY_SIGNING_KEY:?DATABREEZE_IAE_WORKER_CAPABILITY_SIGNING_KEY + must be set} DATABREEZE_LOCAL_MINIO_ENDPOINT: http://minio:9000 DATABREEZE_LOCAL_MINIO_ACCESS_KEY: ${MINIO_ROOT_USER:-databreeze} DATABREEZE_LOCAL_MINIO_SECRET_KEY: ${MINIO_ROOT_PASSWORD} diff --git a/tools/repo-cli/test/lightsail-deployment.test.mjs b/tools/repo-cli/test/lightsail-deployment.test.mjs index 4045363a..edff6bbe 100644 --- a/tools/repo-cli/test/lightsail-deployment.test.mjs +++ b/tools/repo-cli/test/lightsail-deployment.test.mjs @@ -42,6 +42,8 @@ test('Lightsail pilot Compose keeps data services private and gates API on migra 'DATABREEZE_OPENAI_AGENT_ENABLED', 'DATABREEZE_OPENAI_ANALYSIS_ENABLED', 'DATABREEZE_OPENAI_DASHBOARD_ENABLED', + 'DATABREEZE_IAM_INVITATION_DIGEST_KEY', + 'DATABREEZE_IAE_WORKER_CAPABILITY_SIGNING_KEY', 'PAYOS_PROVIDER', 'PAYOS_CLIENT_ID', 'PAYOS_API_KEY', @@ -74,6 +76,11 @@ test('Lightsail environment example keeps secrets and mutable tags out of source assert.match(env, /DATABREEZE_LOCAL_EMAIL_PROVIDER=mailpit/u); assert.match(env, /DATABREEZE_IAM_SMTP_HOST=mailpit/u); assert.match(env, /DATABREEZE_IAM_SMTP_PORT=1025/u); + assert.match(env, /^DATABREEZE_IAM_INVITATION_DIGEST_KEY=CHANGE_ME_43_CHAR_BASE64URL_KEY$/mu); + assert.match( + env, + /^DATABREEZE_IAE_WORKER_CAPABILITY_SIGNING_KEY=CHANGE_ME_43_CHAR_BASE64URL_KEY$/mu, + ); assert.doesNotMatch(env, /OPENAI_API_KEY=/u); assert.doesNotMatch(env, /:latest\b/u); });