"Hey everyone, I noticed that our self-hosting docs for

ENCRYPTION_KEY

currently recommend

openssl rand -hex 16

. When running in FIPS mode, this causes a

CryptographyError

because a 256-bit key is required. I've verified that using

openssl rand -base64 32

resolves this and allows the instance to start correctly with FIPS enabled. I’m planning to submit a PR to update the

envars.mdx

to reflect this requirement. Since the backend handles the key differently in FIPS mode (decoding it as base64), should we update the primary recommendation or add a specific section for FIPS-enabled setups?

Hi Marc! Thanks for flagging this. I will get it taken care of 🙂 Appreciate it!