[P1] Move secrets out of docker-compose.yml (JWT_SECRET, ADMIN_PASSWORD, POSTGRES_PASSWORD) #97

New issue

Open

opened 2026-07-07 16:21:57 +12:00 by fastie81 · 0 comments

fastie81 commented

2026-07-07 16:21:57 +12:00

Owner

Problem

docker-compose.yml contains hardcoded secrets:

Line 22: JWT_SECRET=${JWT_SECRET:-fallback_secret_for_dev_only}
Line 19: ADMIN_PASSWORD=${ADMIN_PASSWORD:-AdminPassword123}
Line 40: POSTGRES_PASSWORD=postgres

Expected Behavior

Use Docker secrets or external .env file:

# docker-compose.yml
environment:
  - JWT_SECRET_FILE=/run/secrets/jwt_secret
  - ADMIN_PASSWORD_FILE=/run/secrets/admin_password

secrets:
  jwt_secret:
    file: ./secrets/jwt_secret.txt
  admin_password:
    file: ./secrets/admin_password.txt

Or at minimum, require all secrets via .env with no defaults.

docker-compose.yml (lines 16-22, 39-41)
Need: .env template without defaults for secrets

### Problem `docker-compose.yml` contains hardcoded secrets: - Line 22: `JWT_SECRET=${JWT_SECRET:-fallback_secret_for_dev_only}` - Line 19: `ADMIN_PASSWORD=${ADMIN_PASSWORD:-AdminPassword123}` - Line 40: `POSTGRES_PASSWORD=postgres` ### Expected Behavior Use Docker secrets or external `.env` file: ```yaml # docker-compose.yml environment: - JWT_SECRET_FILE=/run/secrets/jwt_secret - ADMIN_PASSWORD_FILE=/run/secrets/admin_password secrets: jwt_secret: file: ./secrets/jwt_secret.txt admin_password: file: ./secrets/admin_password.txt ``` Or at minimum, require all secrets via `.env` with no defaults. ### Related Files - `docker-compose.yml` (lines 16-22, 39-41) - Need: `.env` template without defaults for secrets

fastie81 added the

labels

2026-07-07 16:21:57 +12:00