From 36f3f3f3ab1f4707a6d6bc1fd882a604414049e2 Mon Sep 17 00:00:00 2001 From: Waleed Date: Thu, 29 Oct 2026 09:05:38 -0700 Subject: [PATCH] docs(changelog): prepare Self-hosted: OAuth tokens sealed at rest --- .../edition-2026-10-29/production.md | 89 +++++++++++++++++++ 1 file changed, 89 insertions(+) create mode 100644 apps/sim/content/changelog/edition-2026-10-29/production.md diff --git a/apps/sim/content/changelog/edition-2026-10-29/production.md b/apps/sim/content/changelog/edition-2026-10-29/production.md new file mode 100644 index 00000000000..cf4b363e2d2 --- /dev/null +++ b/apps/sim/content/changelog/edition-2026-10-29/production.md @@ -0,0 +1,89 @@ +# Self-hosted: OAuth tokens sealed at rest + +Status: editorial draft. Availability and media require review before an article is added. + +## Editorial selection + +Story type: action_required + +PR #9425 introduces encrypted-at-rest OAuth token storage for self-hosted Sim, enabled by default when ENCRYPTION_KEY is 64 hex characters, with a hard rollback restriction below v0.9.33. This is a clear action_required story: the feature activates automatically with a valid key and imposes an irreversible rollback constraint. Alternatives: #9402 (GPT-6.1 Terra) is a model addition, #9404 (audit rollup) is Enterprise audit, #9436 (Files pagination) has no confirmed UI rollout, #9428 (Search/Assistant) has outstanding worker and feature-flag uncertainty. The security/action-required story beats all alternatives on necessity and breadth of self-hosted operator impact. Merged to staging with no release tag — availability is unverified and owner review is essential before publication. + +## Proposed article + +Sim self-hosted deployments encrypt connected-account OAuth tokens at rest when a valid 64-hex encryption key is set, with a migrate backfill for stored tokens and a rollback restriction below v0.9.33. + +Sim seals connected-account OAuth tokens at rest using `ENCRYPTION_KEY`. When the key is exactly 64 hex characters, each token is encrypted on write and the `migrate` step backfills previously stored tokens in small batches. Without a usable key, tokens continue to be stored in plain text and the app keeps working. + +Set `ENCRYPT_ACCOUNT_TOKENS=false` on the app, background workers, and migrations container to opt out. Already-sealed tokens remain readable when opted out. Once tokens are sealed, do not roll back to a release older than v0.9.33—those releases cannot read sealed tokens, and every connected account would need to be reconnected. See [Account token sealing](https://docs.sim.ai/platform/self-hosting/security) for the full setup, the [upgrade guide](https://docs.sim.ai/platform/self-hosting/upgrades) for rolling-deploy considerations, and the [environment variables reference](https://docs.sim.ai/platform/self-hosting/environment-variables) for key format requirements. + +## Editorial review + +- Removed all 'now' claims from headline, summary, body, social, and email per automatic-draft guidelines — human publication review establishes rollout. +- Removed startup log message detail from body; operators can find it in the linked security guide. Retained in claims for evidence. +- Added 'Already-sealed tokens remain readable when opted out' to body — supported by docs excerpt ('tokens that are already sealed stay readable') and useful for operators evaluating the opt-out. +- Added 'opting out does not unseal stored tokens' to claims — supported by docs callout: 'Opting out does not unseal stored tokens.' +- PR merged to staging with no release tag. Availability is unverified. Owner must confirm rollout status before publication. +- v0.9.33 version number in rollback restriction comes from docs excerpts (security.mdx callout and upgrades.mdx). Owner should confirm this is the correct version before publication. +- Removed three doc links with anchor fragments (#account-token-sealing) and used base verified URLs instead, since only base URLs are in verifiedLinks. + +## Source evidence + +- When ENCRYPTION_KEY is exactly 64 hex characters, Sim encrypts connected-account OAuth tokens on write. Each process logs 'Account token sealing: enabled' with a key id at startup. — simstudioai/sim#9425 +- The migrate step backfills tokens stored before sealing was on in small batches. When upgrading from a release older than v0.9.33, the backfill waits one hour after the upgrade migration before sealing stored tokens, so old pods have time to roll out. — simstudioai/sim#9425 +- Rolling back to a release older than v0.9.33 after tokens are sealed makes every connected account require reconnection, because those releases cannot read sealed tokens. — simstudioai/sim#9425 +- Set ENCRYPT_ACCOUNT_TOKENS=false on the app, background workers, and migrations container to opt out. Already-sealed tokens remain readable when opted out; opting out does not unseal stored tokens. — simstudioai/sim#9425 +- The Helm chart init container and Compose migrations services pass ENCRYPTION_KEY and ENCRYPT_ACCOUNT_TOKENS to the migrations container automatically. Chart bumped to 1.11.10. — simstudioai/sim#9425 + +- https://github.com/simstudioai/sim/pull/9425 + +## Availability and open questions + +- [ ] Has this shipped to Sim Cloud or is it self-hosted only? The PR targets staging with no release tag — owner must confirm availability before publication. +- [ ] Is v0.9.33 the correct minimum version for the rollback restriction, or should the version be confirmed before publication? +- [ ] Should the announcement mention the one-hour grace period during rolling deploys from pre-v0.9.33, or is linking to the upgrade guide sufficient? +- [ ] Owner review needed: confirm rollout status and whether any Cloud-side action is required for users. + +## Links checked during drafting + +- [Account token sealing](https://docs.sim.ai/platform/self-hosting/security) +- [Upgrade guide](https://docs.sim.ai/platform/self-hosting/upgrades) +- [Environment variables](https://docs.sim.ai/platform/self-hosting/environment-variables) + +## Media production + +Format: illustration +Subject: Encrypted-at-rest OAuth token storage concept for self-hosted Sim +Starting state: Abstract token shapes in plain form approaching a server vault +Action: Tokens enter the vault and are sealed with a key +Visible result: Vault closed and locked, tokens stored securely inside +Poster: Vault locked with key visible, tokens sealed inside +Framing: Centered composition, monochrome gouache/graphite on fine paper texture, no text, no fabricated UI, no invented results +Demonstration limits: Illustration only — does not establish behavior or rollout. Feature verified via PR #9425 docs excerpts and security patch. Independent owner review required before publication. + +An editorial illustration representing encrypted-at-rest token storage for a self-hosted deployment. Composition: a restrained monochrome gouache/graphite landscape showing an abstract server vault or strongbox on fine paper texture. Token-like shapes are sealed inside the vault, which is closed with a visible key. No text, no fabricated UI, no invented results. The illustration communicates the concept of encryption at rest without depicting any specific interface. + +1. Illustration: a monochrome gouache/graphite composition on fine paper texture — a locked strongbox or vault with abstract token shapes sealed inside, a key resting nearby. No text, no fabricated UI. + +Suggested alt text: Illustration of abstract token shapes sealed inside a locked vault, representing encrypted-at-rest OAuth token storage in a self-hosted deployment + +- [ ] Independently verify the feature and rollout; record evidence and limitations. +- [ ] Review a product capture, verified diagram, or original editorial illustration; retain capture or generation provenance. +- [ ] Choose the final image or video poster; verify it reads clearly at 390px. Candidate assets are not approved media. +- [ ] Add optimized versioned media, captions if spoken, and index.mdx with draft: true. +- [ ] Verify the final media on desktop and mobile and run the content audit. +- [ ] Feature owner confirms availability; editor approves copy and links. +- [ ] After the approved site deployment, verify article, media, RSS and sitemap before marking published. + +## Announcement drafts + +**Social** + +Sim self-hosted encrypts connected-account OAuth tokens at rest when ENCRYPTION_KEY is a valid 64-hex value. The migrate step backfills stored tokens automatically. Do not roll back below v0.9.33 once tokens are sealed. Details in the security guide. + +**Email** + +If you self-host Sim, connected-account OAuth tokens are encrypted at rest when your ENCRYPTION_KEY is a valid 64-hex value. The migrate step backfills tokens stored before sealing was on. Important: once tokens are sealed, rolling back to a release older than v0.9.33 requires reconnecting every account. See the security guide for opt-out instructions and rolling-deploy guidance. + +Final canonical URL is assigned when the reviewed article slug is chosen. Do not distribute these drafts before publication. + +Editorial contract: apps/sim/content/changelog/README.md and editorial-standard.md. This brief is public repository content; keep private operational evidence in Sim.