Hi all,
I run FS PBX v2.2.2 as an HA pair (two nodes, bidirectional Postgres logical replication, failover by DNS) and ran into something I can't find in the HA docs.
Each node has its own APP_KEY, because install.sh runs `php artisan key:generate` on every install. After I failed over to the second node, the message webhook feature broke. The API returned HTTP 500 and laravel.log showed:
Illuminate\Contracts\Encryption\DecryptException: The MAC is invalid
To confirm it, I read the same tenant's message webhook signing secret on both nodes with tinker. It decrypts fine on node A, where it was saved, and fails on node B. The column is replicated by Postgres, but it is encrypted with node A's APP_KEY, which node B doesn't have. As far as I can tell the same applies to the other encrypted columns (AI API keys, LDAP bind passwords, Homer token, call webhook secrets).
Questions:
1. Is APP_KEY supposed to be identical on both nodes of an HA pair? The HA docs only mention .env for the DB passwords, and I understood the .env files to differ per node.
2. If it should match, can the docs and the HA setup scripts cover it (copy the key before enabling replication)?
3. Is there a recommended way to switch a pair that already has data encrypted under two different keys? Laravel 10 has no APP_PREVIOUS_KEYS fallback, so values encrypted by the other node's key become unreadable.
Thanks!
I run FS PBX v2.2.2 as an HA pair (two nodes, bidirectional Postgres logical replication, failover by DNS) and ran into something I can't find in the HA docs.
Each node has its own APP_KEY, because install.sh runs `php artisan key:generate` on every install. After I failed over to the second node, the message webhook feature broke. The API returned HTTP 500 and laravel.log showed:
Illuminate\Contracts\Encryption\DecryptException: The MAC is invalid
To confirm it, I read the same tenant's message webhook signing secret on both nodes with tinker. It decrypts fine on node A, where it was saved, and fails on node B. The column is replicated by Postgres, but it is encrypted with node A's APP_KEY, which node B doesn't have. As far as I can tell the same applies to the other encrypted columns (AI API keys, LDAP bind passwords, Homer token, call webhook secrets).
Questions:
1. Is APP_KEY supposed to be identical on both nodes of an HA pair? The HA docs only mention .env for the DB passwords, and I understood the .env files to differ per node.
2. If it should match, can the docs and the HA setup scripts cover it (copy the key before enabling replication)?
3. Is there a recommended way to switch a pair that already has data encrypted under two different keys? Laravel 10 has no APP_PREVIOUS_KEYS fallback, so values encrypted by the other node's key become unreadable.
Thanks!
