Remove default credentials from gateway and use file config interpolation for encryption key

.agents/skills/gateway-debug/SKILL.md

@@ -117,12 +117,20 @@ cd "$REPO_ROOT/gateway" && docker compose down
 
 ## Step 2: Prepare the environment
 
-> **One-time provisioning (required before the first `docker compose up`).** Run `./scripts/setup.sh`
-> once from `<REPO_ROOT>/gateway` — it generates `api-platform.env` (required runtime defaults), the
-> router's HTTPS listener certificate, and the AES-256 at-rest encryption key. The gateway never
-> auto-generates keys/certs and has no demo mode: the compose `env_file:` is now `required: true`
-> (a missing `api-platform.env` fails `docker compose up`), and the controller exits at startup if the
-> encryption key is missing. Full reference: [Gateway Quick Start](../../../docs/gateway/quick-start-guide.md).
+> **One-time provisioning (required before the first `docker compose up`).** Run setup once from
+> `<REPO_ROOT>/gateway`. It generates `api-platform.env` (required runtime defaults), the router's HTTPS
+> listener certificate, the AES-256 at-rest encryption key, and the gateway-controller **admin
+> credentials**. Startup fails if basic auth is enabled with no credential, so run it non-interactively
+> with fixed credentials to keep the `-u admin:admin` examples in this skill valid:
+>
+> ```bash
+> ADMIN_USERNAME=admin ADMIN_PASSWORD=admin ./scripts/setup.sh
+> ```
+>
+> The gateway never auto-generates keys/certs and has no demo mode: the compose `env_file:` is now
+> `required: true` (a missing `api-platform.env` fails `docker compose up`), and the controller exits at
+> startup if the encryption key is missing. Full reference:
+> [Gateway Quick Start](../../../docs/gateway/quick-start-guide.md).
 
 > **Compose target — pick one before editing anything.** Step 2 (and Step 8
 > cleanup) operates on **one** compose file. Subsequent substeps reference
@@ -372,7 +380,7 @@ is Go-only. This skill's `dlv` flow does not cover Python; see the
 ## Step 4: Reproduce the issue against the management REST API
 
 The management API runs on `http://localhost:9090/api/management/v0.9`
-(basic auth `admin:admin`). Full endpoint list:
+(basic auth — `admin:admin` if you provisioned it as recommended in Step 2). Full endpoint list:
 `<REPO_ROOT>/gateway/gateway-controller/api/management-openapi.yaml`. Most common:
 
 | Resource | Method + path | Example YAML / response |

.agents/skills/gateway-integration-tests/SKILL.md

@@ -140,8 +140,10 @@ grep -iE '<api-or-policy-name>' "$latest" | grep -iE 'error|warn|fail|panic|reje
 
 ### 4. Reproduce manually for assertion failures
 Bring up only the services you need, deploy the artifact by hand, and inspect.
-The controller exposes two REST APIs (basic auth `admin:admin`); the router is
-`http://localhost:8080`; Envoy admin is `http://localhost:9901`.
+The controller exposes two REST APIs (basic auth `admin:admin` — the plaintext credential hardcoded in
+the IT fixture `gateway/it/test-config.toml`, distinct from the shipped `config.toml`, which provisions
+its admin credential via `setup.sh`); the router is `http://localhost:8080`; Envoy admin is
+`http://localhost:9901`.
 
 - Management API — `http://localhost:9090/api/management/v0.9` — data-plane
   artifacts: REST APIs, LLM providers, LLM proxies, MCP servers, …

.github/workflows/ai-workspace-pr-check.yml

@@ -56,8 +56,9 @@ jobs:
         run: echo "127.0.0.1 host.docker.internal" | sudo tee -a /etc/hosts
 
       - name: Generate quickstart keys, credentials and certificates
-        # setup.sh writes api-platform.env (encryption/JWT keys + admin credentials) and
-        # the TLS certs both services now require. Credentials are pinned to the
+        # setup.sh writes the admin credentials into api-platform.env, and provisions the
+        # at-rest encryption key + RS256 JWT keypair as files under resources/keys (read via
+        # {{ file }}) plus the TLS certs both services require. Credentials are pinned to the
         # Cypress defaults (admin/admin) for the E2E suite.
         run: ADMIN_USERNAME=admin ADMIN_PASSWORD=admin ./setup.sh
         working-directory: portals/ai-workspace

.github/workflows/perf-gateway.yml

@@ -10,6 +10,10 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 60
 
+    env:
+      ADMIN_USERNAME: admin
+      ADMIN_PASSWORD: perf-admin
+
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -31,6 +35,15 @@ jobs:
           test -f gateway/configs/config.toml
           echo "✅ gateway/configs/config.toml exists and is a file"
 
+      - name: Provision gateway secrets + admin credentials
+        run: |
+          cd gateway
+          # Non-interactive: ADMIN_USERNAME/ADMIN_PASSWORD come from the job env.
+          # setup.sh writes api-platform.env (listener cert, AES-256 encryption key,
+          # and the bcrypt-hashed admin credential the controller reads via the
+          # {{ env }} tokens in config.toml). Required now that config.toml
+          ./scripts/setup.sh
+
       - name: Start gateway stack
         run: |
           cd gateway

common/authenticators/authn.go

@@ -79,6 +79,8 @@ func AuthMiddleware(config models.AuthConfig, logger *slog.Logger) (func(http.Ha
 	// No authenticators configured => run in no-auth mode.
 	// This disables both authentication and authorization (via authzSkipKey).
 	if len(authenticators) == 0 {
+		logger.Warn("no authentication method is configured — running with authentication and authorization DISABLED; " +
+			"every request is treated as an authenticated admin. Enable basic auth or an IDP to secure this service.")
 		return func(next http.Handler) http.Handler {
 			return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 				authCtx := models.AuthContext{

distribution/all-in-one/docker-compose.yaml

@@ -94,23 +94,30 @@ services:
       - platform-api-certs:/certs
 
   # One-shot init container: generates the RS256 keypair platform-api's
-  # auth.jwt config requires (config.toml reads it via {{ file }}). Tokens are
+  # auth.jwt config requires AND the 32-byte at-rest encryption key its
+  # security config requires — config.toml reads both via {{ file }}. Tokens are
   # signed asymmetrically — there is no shared HMAC secret anymore.
   platform-api-jwtkeygen:
     image: alpine/openssl
     entrypoint: ["/bin/sh", "-c"]
     command:
       - |
         set -e
-        [ -f /keys/jwt_private.pem ] && [ -f /keys/jwt_public.pem ] && exit 0
-        openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 \
+        # Generate only what's missing — never overwrite an existing JWT keypair
+        # (that would invalidate already-issued tokens) or an existing encryption
+        # key (that would make previously-encrypted data unreadable).
+        [ -f /keys/jwt_private.pem ] || openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 \
           -out /keys/jwt_private.pem 2>/dev/null
-        openssl rsa -in /keys/jwt_private.pem -pubout \
+        [ -f /keys/jwt_public.pem ] || openssl rsa -in /keys/jwt_private.pem -pubout \
           -out /keys/jwt_public.pem 2>/dev/null
+        # At-rest encryption key: 32 bytes as 64 hex chars, read by config.toml
+        # via {{ file "/etc/platform-api/keys/encryption.key" }}.
+        [ -f /keys/encryption.key ] || openssl rand -hex 32 > /keys/encryption.key
+        # Applied every run to both freshly-generated and pre-existing keys.
         # jwtkeygen runs as root; platform-api runs as uid 10001, so the private
-        # key must be owned by that uid, not made world-readable.
-        chown 10001 /keys/jwt_private.pem
-        chmod 0600 /keys/jwt_private.pem
+        # key and encryption key must be owned by that uid, not world-readable.
+        chown 10001 /keys/jwt_private.pem /keys/encryption.key
+        chmod 0600 /keys/jwt_private.pem /keys/encryption.key
         chmod 0644 /keys/jwt_public.pem
     volumes:
       - platform-api-jwt-keys:/keys
@@ -148,9 +155,6 @@ services:
       - APIP_CP_DATABASE_MAX_IDLE_CONNS=10
       - APIP_CP_DATABASE_CONN_MAX_LIFETIME=300
       - APIP_CP_DATABASE_EXECUTE_SCHEMA_DDL=true
-      # Required — set before `docker compose up`, e.g.:
-      #   export APIP_CP_ENCRYPTION_KEY=$(openssl rand -hex 32)
-      - APIP_CP_ENCRYPTION_KEY=${APIP_CP_ENCRYPTION_KEY:-}
     depends_on:
       postgres:
         condition: service_healthy

docs/ai-gateway/llm/guardrails/aws-bedrock-guardrail.md

@@ -113,7 +113,7 @@ Deploy an LLM provider with AWS Bedrock Guardrail validation:
 ```bash
 curl -X POST http://localhost:9090/api/management/v0.9/llm-providers \
   -H "Content-Type: application/yaml" \
-  -H "Authorization: Basic YWRtaW46YWRtaW4=" \
+  -u "$ADMIN_USERNAME:$ADMIN_PASSWORD" \
   --data-binary @- <<'EOF'
 apiVersion: gateway.api-platform.wso2.com/v1
 kind: LlmProvider

docs/ai-gateway/llm/guardrails/azure-content-safety.md

@@ -104,7 +104,7 @@ Deploy an LLM provider with Azure Content Safety validation:
 ```bash
 curl -X POST http://localhost:9090/api/management/v0.9/llm-providers \
   -H "Content-Type: application/yaml" \
-  -H "Authorization: Basic YWRtaW46YWRtaW4=" \
+  -u "$ADMIN_USERNAME:$ADMIN_PASSWORD" \
   --data-binary @- <<'EOF'
 apiVersion: gateway.api-platform.wso2.com/v1
 kind: LlmProvider

docs/ai-gateway/llm/guardrails/content-length.md

@@ -56,7 +56,7 @@ Deploy an LLM provider that limits request payloads to between 100 bytes and 1MB
 ```bash
 curl -X POST http://localhost:9090/api/management/v0.9/llm-providers \
   -H "Content-Type: application/yaml" \
-  -H "Authorization: Basic YWRtaW46YWRtaW4=" \
+  -u "$ADMIN_USERNAME:$ADMIN_PASSWORD" \
   --data-binary @- <<'EOF'
 apiVersion: gateway.api-platform.wso2.com/v1
 kind: LlmProvider

docs/ai-gateway/llm/guardrails/json-schema.md

@@ -65,7 +65,7 @@ Deploy an LLM provider that validates that request contains a user object with r
 ```bash
 curl -X POST http://localhost:9090/api/management/v0.9/llm-providers \
   -H "Content-Type: application/yaml" \
-  -H "Authorization: Basic YWRtaW46YWRtaW4=" \
+  -u "$ADMIN_USERNAME:$ADMIN_PASSWORD" \
   --data-binary @- <<'EOF'
 apiVersion: gateway.api-platform.wso2.com/v1
 kind: LlmProvider

docs/ai-gateway/llm/guardrails/pii-masking-regex.md

@@ -66,7 +66,7 @@ Deploy an LLM provider that masks email addresses and phone numbers in requests
 ```bash
 curl -X POST http://localhost:9090/api/management/v0.9/llm-providers \
   -H "Content-Type: application/yaml" \
-  -H "Authorization: Basic YWRtaW46YWRtaW4=" \
+  -u "$ADMIN_USERNAME:$ADMIN_PASSWORD" \
   --data-binary @- <<'EOF'
 apiVersion: gateway.api-platform.wso2.com/v1
 kind: LlmProvider

docs/ai-gateway/llm/guardrails/regex.md

@@ -65,7 +65,7 @@ Deploy an LLM provider that protects against sensitive data leaks by blocking an
 ```bash
 curl -X POST http://localhost:9090/api/management/v0.9/llm-providers \
   -H "Content-Type: application/yaml" \
-  -H "Authorization: Basic YWRtaW46YWRtaW4=" \
+  -u "$ADMIN_USERNAME:$ADMIN_PASSWORD" \
   --data-binary @- <<'EOF'
 apiVersion: gateway.api-platform.wso2.com/v1
 kind: LlmProvider

docs/ai-gateway/llm/guardrails/semantic-prompt-guard.md

@@ -115,7 +115,7 @@ Deploy an LLM provider that blocks prompts similar to prohibited phrases:
 ```bash
 curl -X POST http://localhost:9090/api/management/v0.9/llm-providers \
   -H "Content-Type: application/yaml" \
-  -H "Authorization: Basic YWRtaW46YWRtaW4=" \
+  -u "$ADMIN_USERNAME:$ADMIN_PASSWORD" \
   --data-binary @- <<'EOF'
 apiVersion: gateway.api-platform.wso2.com/v1
 kind: LlmProvider
@@ -195,7 +195,7 @@ Deploy an LLM provider that only allows prompts similar to approved phrases:
 ```bash
 curl -X POST http://localhost:9090/api/management/v0.9/llm-providers \
   -H "Content-Type: application/yaml" \
-  -H "Authorization: Basic YWRtaW46YWRtaW4=" \
+  -u "$ADMIN_USERNAME:$ADMIN_PASSWORD" \
   --data-binary @- <<'EOF'
 apiVersion: gateway.api-platform.wso2.com/v1
 kind: LlmProvider

docs/ai-gateway/llm/guardrails/sentence-count.md

@@ -65,7 +65,7 @@ Deploy an LLM provider that ensures requests contain between 1 and 10 sentences:
 ```bash
 curl -X POST http://localhost:9090/api/management/v0.9/llm-providers \
   -H "Content-Type: application/yaml" \
-  -H "Authorization: Basic YWRtaW46YWRtaW4=" \
+  -u "$ADMIN_USERNAME:$ADMIN_PASSWORD" \
   --data-binary @- <<'EOF'
 apiVersion: gateway.api-platform.wso2.com/v1
 kind: LlmProvider

docs/ai-gateway/llm/guardrails/url.md

@@ -73,7 +73,7 @@ Deploy an LLM provider that validates URLs in request content using HTTP HEAD re
 ```bash
 curl -X POST http://localhost:9090/api/management/v0.9/llm-providers \
   -H "Content-Type: application/yaml" \
-  -H "Authorization: Basic YWRtaW46YWRtaW4=" \
+  -u "$ADMIN_USERNAME:$ADMIN_PASSWORD" \
   --data-binary @- <<'EOF'
 apiVersion: gateway.api-platform.wso2.com/v1
 kind: LlmProvider

docs/ai-gateway/llm/guardrails/word-count.md

@@ -56,7 +56,7 @@ Deploy an LLM provider that validates request messages contain between 10 and 50
 ```bash
 curl -X POST http://localhost:9090/api/management/v0.9/llm-providers \
   -H "Content-Type: application/yaml" \
-  -H "Authorization: Basic YWRtaW46YWRtaW4=" \
+  -u "$ADMIN_USERNAME:$ADMIN_PASSWORD" \
   --data-binary @- <<'EOF'
 apiVersion: gateway.api-platform.wso2.com/v1
 kind: LlmProvider

docs/ai-gateway/llm/llm-templates.md

@@ -284,7 +284,7 @@ To create an LLM provider using any of the out-of-the-box templates:
 ```bash
 curl -X POST http://localhost:9090/api/management/v0.9/llm-providers \
   -H "Content-Type: application/yaml" \
-  -H "Authorization: Basic YWRtaW46YWRtaW4=" \
+  -u "$ADMIN_USERNAME:$ADMIN_PASSWORD" \
   --data-binary @- <<'EOF'
 apiVersion: gateway.api-platform.wso2.com/v1
 kind: LlmProvider
@@ -333,7 +333,7 @@ To list all available LLM provider templates:
 
 ```bash
 curl -X GET http://localhost:9090/api/management/v0.9/llm-provider-templates \
-  -H "Authorization: Basic YWRtaW46YWRtaW4="
+  -u "$ADMIN_USERNAME:$ADMIN_PASSWORD"
 ```
 
 ### Retrieving a Specific Template
@@ -342,7 +342,7 @@ To retrieve details of a specific template:
 
 ```bash
 curl -X GET http://localhost:9090/api/management/v0.9/llm-provider-templates/openai \
-  -H "Authorization: Basic YWRtaW46YWRtaW4="
+  -u "$ADMIN_USERNAME:$ADMIN_PASSWORD"
 ```
 
 ### Creating Custom Templates
@@ -352,7 +352,7 @@ Platform administrators can create custom templates for LLM providers not covere
 ```bash
 curl -X POST http://localhost:9090/api/management/v0.9/llm-provider-templates \
   -H "Content-Type: application/yaml" \
-  -H "Authorization: Basic YWRtaW46YWRtaW4=" \
+  -u "$ADMIN_USERNAME:$ADMIN_PASSWORD" \
   --data-binary @- <<'EOF'
 apiVersion: gateway.api-platform.wso2.com/v1
 kind: LlmProviderTemplate
@@ -373,7 +373,7 @@ To update an existing custom template:
 ```bash
 curl -X PUT http://localhost:9090/api/management/v0.9/llm-provider-templates/custom-provider \
   -H "Content-Type: application/yaml" \
-  -H "Authorization: Basic YWRtaW46YWRtaW4=" \
+  -u "$ADMIN_USERNAME:$ADMIN_PASSWORD" \
   --data-binary @- <<'EOF'
 apiVersion: gateway.api-platform.wso2.com/v1
 kind: LlmProviderTemplate
@@ -394,7 +394,7 @@ To delete a custom template:
 
 ```bash
 curl -X DELETE http://localhost:9090/api/management/v0.9/llm-provider-templates/custom-provider \
-  -H "Authorization: Basic YWRtaW46YWRtaW4="
+  -u "$ADMIN_USERNAME:$ADMIN_PASSWORD"
 ```
 
 **Note**: Out-of-the-box templates cannot be deleted or modified. Only custom templates created by platform administrators can be updated or deleted.

docs/ai-gateway/llm/load-balancing/model-round-robin.md

@@ -55,7 +55,7 @@ Deploy an LLM provider with round-robin load balancing across multiple models:
 ```bash
 curl -X POST http://localhost:9090/api/management/v0.9/llm-providers \
   -H "Content-Type: application/yaml" \
-  -H "Authorization: Basic YWRtaW46YWRtaW4=" \
+  -u "$ADMIN_USERNAME:$ADMIN_PASSWORD" \
   --data-binary @- <<'EOF'
 apiVersion: gateway.api-platform.wso2.com/v1
 kind: LlmProvider

docs/ai-gateway/llm/load-balancing/model-weighted-round-robin.md

@@ -70,7 +70,7 @@ Deploy an LLM provider with weighted round-robin load balancing:
 ```bash
 curl -X POST http://localhost:9090/api/management/v0.9/llm-providers \
   -H "Content-Type: application/yaml" \
-  -H "Authorization: Basic YWRtaW46YWRtaW4=" \
+  -u "$ADMIN_USERNAME:$ADMIN_PASSWORD" \
   --data-binary @- <<'EOF'
 apiVersion: gateway.api-platform.wso2.com/v1
 kind: LlmProvider

docs/ai-gateway/llm/prompt-management/prompt-decorator.md

@@ -84,7 +84,7 @@ Add a summarization instruction to user prompts:
 ```bash
 curl -X POST http://localhost:9090/api/management/v0.9/llm-providers \
   -H "Content-Type: application/yaml" \
-  -H "Authorization: Basic YWRtaW46YWRtaW4=" \
+  -u "$ADMIN_USERNAME:$ADMIN_PASSWORD" \
   --data-binary @- <<'EOF'
 apiVersion: gateway.api-platform.wso2.com/v1
 kind: LlmProvider
@@ -157,7 +157,7 @@ Add a system message to define AI behavior:
 ```bash
 curl -X POST http://localhost:9090/api/management/v0.9/llm-providers \
   -H "Content-Type: application/yaml" \
-  -H "Authorization: Basic YWRtaW46YWRtaW4=" \
+  -u "$ADMIN_USERNAME:$ADMIN_PASSWORD" \
   --data-binary @- <<'EOF'
 apiVersion: gateway.api-platform.wso2.com/v1
 kind: LlmProvider

docs/ai-gateway/llm/prompt-management/prompt-template.md

@@ -81,7 +81,7 @@ Deploy an LLM provider with a translation prompt template:
 ```bash
 curl -X POST http://localhost:9090/api/management/v0.9/llm-providers \
   -H "Content-Type: application/yaml" \
-  -H "Authorization: Basic YWRtaW46YWRtaW4=" \
+  -u "$ADMIN_USERNAME:$ADMIN_PASSWORD" \
   --data-binary @- <<'EOF'
 apiVersion: gateway.api-platform.wso2.com/v1
 kind: LlmProvider
@@ -154,7 +154,7 @@ Create a template for summarizing content with configurable length:
 ```bash
 curl -X POST http://localhost:9090/api/management/v0.9/llm-providers \
   -H "Content-Type: application/yaml" \
-  -H "Authorization: Basic YWRtaW46YWRtaW4=" \
+  -u "$ADMIN_USERNAME:$ADMIN_PASSWORD" \
   --data-binary @- <<'EOF'
 apiVersion: gateway.api-platform.wso2.com/v1
 kind: LlmProvider

docs/ai-gateway/llm/quick-start-guide.md

@@ -40,10 +40,18 @@ curl http://localhost:9094/health
 
 The API Platform Gateway currently includes first-class support for the OpenAI LLM provider. As a platform administrator, replace `<openai-apikey>` with your openai API key and run the following command to deploy a sample OpenAI LLM provider.
 
+> The management API uses basic auth. Export the admin credentials `scripts/setup.sh` provisioned — the
+> username defaults to `admin`; use the password it printed:
+>
+> ```bash
+> export ADMIN_USERNAME=admin
+> export ADMIN_PASSWORD='<the password scripts/setup.sh printed>'
+> ```
+
 ```bash
 curl -X POST http://localhost:9090/api/management/v0.9/llm-providers \
   -H "Content-Type: application/yaml" \
-  -H "Authorization: Basic YWRtaW46YWRtaW4=" \
+  -u "$ADMIN_USERNAME:$ADMIN_PASSWORD" \
   --data-binary @- <<'EOF'
 apiVersion: gateway.api-platform.wso2.com/v1
 kind: LlmProvider
@@ -95,7 +103,7 @@ The API Platform Gateway provides first-class support for configuring and deploy
 ```bash
 curl -X POST http://localhost:9090/api/management/v0.9/llm-proxies \
   -H "Content-Type: application/yaml" \
-  -H "Authorization: Basic YWRtaW46YWRtaW4=" \
+  -u "$ADMIN_USERNAME:$ADMIN_PASSWORD" \
   --data-binary @- <<'EOF'
 apiVersion: gateway.api-platform.wso2.com/v1
 kind: LlmProxy

docs/ai-gateway/llm/semantic-caching.md

@@ -118,7 +118,7 @@ Deploy an LLM provider with semantic caching using OpenAI embeddings and Redis v
 ```bash
 curl -X POST http://localhost:9090/api/management/v0.9/llm-providers \
   -H "Content-Type: application/yaml" \
-  -H "Authorization: Basic YWRtaW46YWRtaW4=" \
+  -u "$ADMIN_USERNAME:$ADMIN_PASSWORD" \
   --data-binary @- <<'EOF'
 apiVersion: gateway.api-platform.wso2.com/v1
 kind: LlmProvider