fix: remove hardcoded Engine API JWT secret and require explicit configuration

.env.mainnet

@@ -42,7 +42,9 @@ OP_NODE_L2_ENGINE_RPC=http://execution:8551
 
 BASE_NODE_L2_ENGINE_RPC=ws://execution:8551
 BASE_NODE_L2_ENGINE_AUTH=/tmp/engine-auth-jwt
-BASE_NODE_L2_ENGINE_AUTH_RAW=688f5d737bad920bdfb2fc2f488d6b6209eebda1dae949a8de91398d932c517a
+# [REQUIRED] Set this to a secret hex string shared by the execution and consensus containers.
+# Generate one with: openssl rand -hex 32
+BASE_NODE_L2_ENGINE_AUTH_RAW=<your-secret-jwt>
 
 # P2P CONFIGURATION
 # ---------------

.env.sepolia

@@ -42,7 +42,9 @@ OP_NODE_L2_ENGINE_RPC=ws://execution:8551
 
 BASE_NODE_L2_ENGINE_RPC=http://execution:8551
 BASE_NODE_L2_ENGINE_AUTH=/tmp/engine-auth-jwt
-BASE_NODE_L2_ENGINE_AUTH_RAW=688f5d737bad920bdfb2fc2f488d6b6209eebda1dae949a8de91398d932c517a
+# [REQUIRED] Set this to a secret hex string shared by the execution and consensus containers.
+# Generate one with: openssl rand -hex 32
+BASE_NODE_L2_ENGINE_AUTH_RAW=<your-secret-jwt>
 
 # P2P CONFIGURATION
 # ---------------

README.md

@@ -83,6 +83,13 @@ Supported clients:
 
 ### Required Settings
 
+- Engine API JWT Secret:
+  - `BASE_NODE_L2_ENGINE_AUTH_RAW`: A 32-byte hex secret shared between the execution and consensus containers. **You must generate this yourself — do not use a public or default value.**
+    ```bash
+    openssl rand -hex 32
+    ```
+    Set the output as `BASE_NODE_L2_ENGINE_AUTH_RAW` in your `.env` file. Both containers must use the same value.
+
 - L1 Configuration:
   - `OP_NODE_L1_ETH_RPC`: Your Ethereum L1 node RPC endpoint
   - `OP_NODE_L1_BEACON`: Your L1 beacon node endpoint

base-consensus-entrypoint

@@ -42,6 +42,12 @@ else
 fi
 export BASE_NODE_P2P_ADVERTISE_IP=$PUBLIC_IP
 
+if [[ -z "${BASE_NODE_L2_ENGINE_AUTH_RAW:-}" || "${BASE_NODE_L2_ENGINE_AUTH_RAW}" == "<your-secret-jwt>" ]]; then
+  echo "ERROR: BASE_NODE_L2_ENGINE_AUTH_RAW is not set." >&2
+  echo "Generate a secret and set it in your .env file:" >&2
+  echo "  BASE_NODE_L2_ENGINE_AUTH_RAW=\$(openssl rand -hex 32)" >&2
+  exit 1
+fi
 echo "$BASE_NODE_L2_ENGINE_AUTH_RAW" > "$BASE_NODE_L2_ENGINE_AUTH"
 
 if [[ -n "${BASE_NODE_SOURCE_L2_RPC:-}" ]]; then

geth/geth-entrypoint

@@ -28,6 +28,12 @@ fi
 
 mkdir -p $GETH_DATA_DIR
 
+if [[ -z "${BASE_NODE_L2_ENGINE_AUTH_RAW:-}" || "${BASE_NODE_L2_ENGINE_AUTH_RAW}" == "<your-secret-jwt>" ]]; then
+    echo "ERROR: BASE_NODE_L2_ENGINE_AUTH_RAW is not set." >&2
+    echo "Generate a secret and set it in your .env file:" >&2
+    echo "  BASE_NODE_L2_ENGINE_AUTH_RAW=\$(openssl rand -hex 32)" >&2
+    exit 1
+fi
 echo "$BASE_NODE_L2_ENGINE_AUTH_RAW" > "$BASE_NODE_L2_ENGINE_AUTH"
 
 if [ "${OP_GETH_ETH_STATS+x}" = x ]; then

op-node-entrypoint

@@ -43,6 +43,12 @@ fi
 export OP_NODE_P2P_ADVERTISE_IP=$PUBLIC_IP
 
 
+if [[ -z "${BASE_NODE_L2_ENGINE_AUTH_RAW:-}" || "${BASE_NODE_L2_ENGINE_AUTH_RAW}" == "<your-secret-jwt>" ]]; then
+  echo "ERROR: BASE_NODE_L2_ENGINE_AUTH_RAW is not set." >&2
+  echo "Generate a secret and set it in your .env file:" >&2
+  echo "  BASE_NODE_L2_ENGINE_AUTH_RAW=\$(openssl rand -hex 32)" >&2
+  exit 1
+fi
 echo "$BASE_NODE_L2_ENGINE_AUTH_RAW" > "$BASE_NODE_L2_ENGINE_AUTH"
 export OP_NODE_L2_ENGINE_AUTH=$BASE_NODE_L2_ENGINE_AUTH
 

reth/reth-entrypoint

@@ -129,6 +129,13 @@ fi
 
 mkdir -p "$RETH_DATA_DIR"
 echo "Starting reth with additional args: $ADDITIONAL_ARGS"
+
+if [[ -z "${BASE_NODE_L2_ENGINE_AUTH_RAW:-}" || "${BASE_NODE_L2_ENGINE_AUTH_RAW}" == "<your-secret-jwt>" ]]; then
+    echo "ERROR: BASE_NODE_L2_ENGINE_AUTH_RAW is not set." >&2
+    echo "Generate a secret and set it in your .env file:" >&2
+    echo "  BASE_NODE_L2_ENGINE_AUTH_RAW=\$(openssl rand -hex 32)" >&2
+    exit 1
+fi
 echo "$BASE_NODE_L2_ENGINE_AUTH_RAW" > "$BASE_NODE_L2_ENGINE_AUTH"
 
 exec "$BINARY" node \