From 1457dc7289b4f278fa85036cfa5d25e5d62f1f7e Mon Sep 17 00:00:00 2001 From: John O'Keefe Date: Thu, 29 Oct 2026 11:02:41 -0400 Subject: [PATCH] =?UTF-8?q?docs(env):=20DBSRVPASS=20in=20.env.example=20?= =?UTF-8?q?=E2=80=94=20the=20runtime=20role=20password?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit .env.example is the template prod/new deployments copy; it was missing the runtime role password the app now requires (DATABASE_USER bookhoard_srv). Notes distinguish it from the bootstrap DBPASS and point existing-volume operators at the one-time z_rls_role.sh run. --- .env.example | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/.env.example b/.env.example index 8ee920a1..be27dd59 100644 --- a/.env.example +++ b/.env.example @@ -6,10 +6,19 @@ # Generate with: openssl rand -hex 32 JWT_SECRET=your-secure-jwt-secret-key-here -# PostgreSQL database password +# PostgreSQL database password (the bootstrap superuser account; kept +# for container initialization — the app itself connects as bookhoard_srv) # Generate with: openssl rand -hex 16 DBPASS=your-secure-database-password-here +# Runtime database role password (bookhoard_srv — the non-superuser +# account the app connects as; subject to RLS). Required for the app to +# start. On a fresh volume it is consumed by database/schema/z_rls_role.sh +# during first initialization; on an existing volume, run that script once +# (see its header) BEFORE starting the app with DATABASE_USER=bookhoard_srv. +# Generate with: openssl rand -hex 16 +DBSRVPASS=your-secure-runtime-role-password-here + # Networking: change a port if it conflicts on your host # Postgres port, host + container (e.g. another local DB already uses 5432) # DB_PORT=15432