fix: fail fast when Engine API JWT secret is left at shared default

[erhnysr]

Fixes #1159.

.env.mainnet and .env.sepolia shipped the same hardcoded BASE_NODE_L2_ENGINE_AUTH_RAW, so a deployment that never overrides it silently runs on a shared default. This replaces the committed value with a placeholder and makes both entrypoints fail fast when the placeholder is still in place.

Changes

• .env.mainnet / .env.sepolia: replace the hardcoded secret with <your-secret-jwt> and a # [REQUIRED] Generate with: openssl rand -hex 32 comment.
• consensus-entrypoint: existing non-empty check now also rejects the placeholder, with a message pointing at openssl rand -hex 32.
• execution-entrypoint: add the same guard before the secret is written to the JWT file, so reth never starts on the placeholder.

Behaviour

• Before: an unconfigured node starts successfully on the shared default with no warning.
• After: an unconfigured node exits with a clear error instructing the operator to generate a secret. A properly configured node is unaffected.

Minimal by design — placeholder + guard only, no doc restructuring.

[cb-heimdall]

🟡 Heimdall Review Status

Requirement	Status	More Info
Reviews	🟡 0/1	Denominator calculation Show calculation 1 if user is bot 0 1 if user is external 0 2 if repo is sensitive 0 From .codeflow.yml 1 Additional review requirements Show calculation Max 0 0 From CODEOWNERS 0 Global minimum 0 Max 1 1 1 if commit is unverified 0 Sum 1

[erhnysr]

Still live on today's main (552280f)

Pulled and re-checked against current main. .env.mainnet:24 and .env.sepolia:24 both still ship the same secret — BASE_NODE_L2_ENGINE_AUTH_RAW=688f5d737bad920bdfb2fc2f488d6b6209eebda1dae949a8de91398d932c517a. consensus-entrypoint only guards with -z (empty), so a node started from the committed .env runs on that shared default without complaint, and execution-entrypoint has no check at all — it writes whatever's in the variable and execs reth.

Guard verified both ways

Ran the guard directly (the exact block from each entrypoint, not through a full Docker run) both ways:

• Placeholder left in place → fails fast, exit 1:

  ERROR: BASE_NODE_L2_ENGINE_AUTH_RAW is not set or still uses the placeholder value.
  Generate a secret and set it in your .env file:
    BASE_NODE_L2_ENGINE_AUTH_RAW=$(openssl rand -hex 32)
  

• Secret from openssl rand -hex 32 → clears the guard and proceeds (consensus advances to waiting for execution client to be ready; execution reaches the jwt write + exec reth).

Precedent

None of the comparable clients commit a usable shared secret:

• reth — etc/generate-jwt.sh runs openssl rand -hex 32; etc/docker-compose.yml ships no value, just mounts the generated jwt.hex.
• op-node — the kona-node docker recipe generates with openssl rand -hex 32; simple-optimism-node does openssl rand -hex 32 > $BEDROCK_JWT_PATH.
• nethermind — auto-generates a fresh per-instance secret at keystore/jwt-secret if none is supplied (docs).

base/node is the only one of the four committing a working shared secret to version control.