From 41f7099fb391b43fd23a168c61dd70e1affbe716 Mon Sep 17 00:00:00 2001 From: Luiz Gustavo Date: Thu, 4 Jun 2026 04:07:34 -0300 Subject: [PATCH] fix(realtime): use a 16-byte DB_ENC_KEY so the container stops crash-looping MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit disclosure-realtime had been restarting on a ~60 s cycle since the stack was brought up — RestartCount climbed past 29,000. The seed step crashed with `{:badarg, 'Bad key size'}` from `:crypto.crypto_one_time(:aes_128_ecb, "ca2c785fedb0a728dbf2c0e4fcb5d2bf", …)`. The Supabase Realtime image expects DB_ENC_KEY to be a raw 16-byte key for AES-128-ECB, but VAULT_ENC_KEY (the value it was being mapped to) is a 32-char hex string — 32 bytes when read verbatim, which AES-128 rejects. Fix: separate the realtime key from the Vault key. New env REALTIME_ENC_KEY holds a fresh 16-byte ASCII string and the compose now maps DB_ENC_KEY to that. VAULT_ENC_KEY stays untouched for whenever the Postgres Vault extension is actually used (`vault.secrets` has zero rows, so nothing was encrypted under the old shared key). Verified live: realtime restarted clean (Restarts=0, ExitCode=0, stable across 100 s of polling), seed succeeded (public.tenants now has the 'realtime-dev' row), Tzdata refreshed to 2026b, RealtimeWeb.Endpoint listening on :4000. The dockerd churn from ~one recreate per second is gone. Co-Authored-By: Claude Opus 4.7 (1M context) --- infra/disclosure-stack/docker-compose.yml | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/infra/disclosure-stack/docker-compose.yml b/infra/disclosure-stack/docker-compose.yml index 4356b64..6bca109 100644 --- a/infra/disclosure-stack/docker-compose.yml +++ b/infra/disclosure-stack/docker-compose.yml @@ -129,7 +129,12 @@ services: DB_USER: supabase_admin DB_PASSWORD: ${POSTGRES_PASSWORD} DB_NAME: postgres - DB_ENC_KEY: ${VAULT_ENC_KEY} + # Realtime AES-128-ECB encrypts tenant secrets with this key. The key + # must be EXACTLY 16 bytes raw (not 32 hex chars). Sharing VAULT_ENC_KEY + # used to crash the container in a tight restart loop because that env + # is a 32-char hex string. Kept separate so the Vault extension can keep + # its own key shape. + DB_ENC_KEY: ${REALTIME_ENC_KEY} API_JWT_SECRET: ${JWT_SECRET} SECRET_KEY_BASE: ${SECRET_KEY_BASE} ERL_AFLAGS: -proto_dist inet_tcp