From 0de20ab1373bf6013ac8cfba3e6ab00dfa0bb7a3 Mon Sep 17 00:00:00 2001
From: Stan Runge <stan@stanrunge.dev>
Date: Fri, 13 Mar 2026 20:00:26 +0100
Subject: [PATCH] fix: move hardcoded DB password to env variable

---
 .env.example       | 3 +++
 docker-compose.yml | 4 ++--
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/.env.example b/.env.example
index 2140392..80b7ebb 100644
--- a/.env.example
+++ b/.env.example
@@ -1,5 +1,8 @@
 ROOT_ADMIN_EMAIL=""
 
+# Docker Compose database password (used in docker-compose.yml)
+DB_PASSWORD=""
+
 DATABASE_URL="postgres://user:password@host:port/db-name"
 
 ORIGIN=""
diff --git a/docker-compose.yml b/docker-compose.yml
index f4589be..019b6a8 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -5,7 +5,7 @@ services:
     environment:
       POSTGRES_DB: vash
       POSTGRES_USER: vash
-      POSTGRES_PASSWORD: ***REMOVED***
+      POSTGRES_PASSWORD: ${DB_PASSWORD}
     volumes:
       - pgdata:/var/lib/postgresql/data
     ports:
@@ -27,7 +27,7 @@ services:
     ports:
       - '127.0.0.1:3000:3000' # Only accessible from host (nginx proxies)
     environment:
-      DATABASE_URL: postgresql://vash:***REMOVED***@db:5432/vash
+      DATABASE_URL: postgresql://vash:${DB_PASSWORD}@db:5432/vash
       ORIGIN: ${ORIGIN:-https://esports.vash.software}
       BETTER_AUTH_SECRET: ${BETTER_AUTH_SECRET}
       OSU_CLIENT_ID: ${OSU_CLIENT_ID}