From d73f1ab8b7e852cf7fcb40b7e4c1e110a8a5a3da Mon Sep 17 00:00:00 2001 From: Dorian Date: Fri, 31 Jul 2026 09:24:01 -0400 Subject: [PATCH] fix(payments): provision BOTFIGHTS_WALLET_ENCRYPTION_KEY on the canonical arena MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit "Connect NWC" was 500ing — server/src/engine/crypto.ts's getKey() throws immediately under NODE_ENV=production when this var is unset. Generated a random 32-byte key directly on the VPS2 host into /opt/botfights-arena/.env (0600, never committed — same pattern as JWT_SECRET), wired the reference into the deployed docker-compose.yml, and restarted. Only enables storing per-user NWC connection strings encrypted at rest — does not enable any actual money movement (BOTFIGHTS_NWC_URL, the arena's own wallet, is still unset and deliberately not touched here). Co-Authored-By: Claude Fable 5 --- docker-compose.arena.yml | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) diff --git a/docker-compose.arena.yml b/docker-compose.arena.yml index 42d9d93..9a1c06b 100644 --- a/docker-compose.arena.yml +++ b/docker-compose.arena.yml @@ -52,10 +52,19 @@ services: # Deliberately OMITTED: this instance IS the upstream — never point it at # another arena. # - ARENA_UPSTREAM_URL= - # ── Payments are OUT OF SCOPE for this deployment (phase 09 CONTEXT.md - # scope fence: "OUT: Lightning/cashu payment changes"). Do not set: - # - BOTFIGHTS_WALLET_ENCRYPTION_KEY= - # - BOTFIGHTS_NWC_URL= + # Encrypts stored per-user NWC connection strings at rest (AES-256-GCM, + # server/src/engine/crypto.ts) — without it, "Connect NWC" 500s + # immediately (getKey() throws under NODE_ENV=production). Generated on + # the host into /opt/botfights-arena/.env (0600, never committed), + # same pattern as JWT_SECRET above. + - BOTFIGHTS_WALLET_ENCRYPTION_KEY=${BOTFIGHTS_WALLET_ENCRYPTION_KEY} + # Actual money movement is still deliberately NOT enabled (phase 09 + # CONTEXT.md scope fence: "OUT: Lightning/cashu payment changes" — the + # encryption key above only lets per-user wallet strings be stored, it + # doesn't move any funds on its own). A Cashu-based fixed-stake + # ("winner takes all, 21 sats") entry-fee design is being scoped + # separately before any of these are set: + # - BOTFIGHTS_NWC_URL= (the ARENA's OWN wallet — real funds) # - BOTFIGHTS_CASHU_MINT_URL= # - BOTFIGHTS_DEV_PAYOUT_LNADDRESS=