Variabilize passwords as env vars to follow the best practice that passwords should not be stored in config files.

Author: cyrille-leclerc

.env

@@ -173,6 +173,8 @@ VALKEY_ADDR=valkey-cart:${VALKEY_PORT}
 POSTGRES_HOST=astronomy-db
 POSTGRES_PORT=5432
 POSTGRES_PASSWORD=changeit
+POSTGRES_ASTRONOMY_PASSWORD=astronomy_password    # defined in src/postgresql/init.sql
+POSTGRES_MONITORING_PASSWORD=monitoring_password  # defined in src/postgresql/init.sql
 POSTGRES_DOCKERFILE=./src/postgresql/Dockerfile
 
 # ********************

docker-compose.minimal.yml

@@ -425,7 +425,7 @@ services:
       - OTEL_SERVICE_NAME=product-catalog
       - OTEL_CONFIG_FILE=/otel-config.yml
       - OTEL_SEMCONV_STABILITY_OPT_IN=database
-      - DB_CONNECTION_STRING=postgres://astronomy_user:astronomy_password@${POSTGRES_HOST}/astronomy_db?sslmode=disable
+      - DB_CONNECTION_STRING=postgres://astronomy_user:${POSTGRES_ASTRONOMY_PASSWORD}@${POSTGRES_HOST}/astronomy_db?sslmode=disable
     depends_on:
       otel-collector:
         condition: service_started
@@ -460,7 +460,7 @@ services:
       - OTEL_SERVICE_NAME=product-reviews
       - OTEL_INSTRUMENTATION_GENAI_CAPTURE_MESSAGE_CONTENT=true
       - PROTOCOL_BUFFERS_PYTHON_IMPLEMENTATION=python
-      - DB_CONNECTION_STRING=host=${POSTGRES_HOST} user=astronomy_user password=astronomy_password dbname=astronomy_db
+      - DB_CONNECTION_STRING=host=${POSTGRES_HOST} user=astronomy_user password=${POSTGRES_ASTRONOMY_PASSWORD} dbname=astronomy_db
       - LLM_BASE_URL
       - OPENAI_API_KEY
       - LLM_MODEL
@@ -743,6 +743,7 @@ services:
       - POSTGRES_HOST
       - POSTGRES_PORT
       - POSTGRES_PASSWORD
+      - POSTGRES_MONITORING_PASSWORD
       - GOMEMLIMIT=160MiB
 
   # Prometheus

docker-compose.yml

@@ -37,7 +37,7 @@ services:
       - OTEL_EXPORTER_OTLP_METRICS_TEMPORALITY_PREFERENCE
       - OTEL_RESOURCE_ATTRIBUTES
       - OTEL_SERVICE_NAME=accounting
-      - DB_CONNECTION_STRING=Host=${POSTGRES_HOST};Username=astronomy_user;Password=astronomy_password;Database=astronomy_db
+      - DB_CONNECTION_STRING=Host=${POSTGRES_HOST};Username=astronomy_user;Password=${POSTGRES_ASTRONOMY_PASSWORD};Database=astronomy_db
       - OTEL_DOTNET_AUTO_TRACES_ENTITYFRAMEWORKCORE_INSTRUMENTATION_ENABLED=false
     depends_on:
       otel-collector:
@@ -504,7 +504,7 @@ services:
       - OTEL_SERVICE_NAME=product-catalog
       - OTEL_CONFIG_FILE=/otel-config.yml
       - OTEL_SEMCONV_STABILITY_OPT_IN=database
-      - DB_CONNECTION_STRING=postgres://astronomy_user:astronomy_password@${POSTGRES_HOST}/astronomy_db?sslmode=disable
+      - DB_CONNECTION_STRING=postgres://astronomy_user:${POSTGRES_ASTRONOMY_PASSWORD}@${POSTGRES_HOST}/astronomy_db?sslmode=disable
     depends_on:
       otel-collector:
         condition: service_started
@@ -541,7 +541,7 @@ services:
       - OTEL_SERVICE_NAME=product-reviews
       - OTEL_INSTRUMENTATION_GENAI_CAPTURE_MESSAGE_CONTENT=true
       - PROTOCOL_BUFFERS_PYTHON_IMPLEMENTATION=python
-      - DB_CONNECTION_STRING=host=${POSTGRES_HOST} user=astronomy_user password=astronomy_password dbname=astronomy_db
+      - DB_CONNECTION_STRING=host=${POSTGRES_HOST} user=astronomy_user password=${POSTGRES_ASTRONOMY_PASSWORD} dbname=astronomy_db
       - LLM_BASE_URL
       - OPENAI_API_KEY
       - LLM_MODEL
@@ -893,6 +893,7 @@ services:
       - POSTGRES_HOST
       - POSTGRES_PORT
       - POSTGRES_PASSWORD
+      - POSTGRES_MONITORING_PASSWORD
       - GOMEMLIMIT=160MiB
 
   # Prometheus

src/otel-collector/otelcol-config.yml

@@ -25,7 +25,7 @@ receivers:
   postgresql:
     endpoint: ${POSTGRES_HOST}:${POSTGRES_PORT}
     username: monitoring_user
-    password: monitoring_password
+    password: ${env:POSTGRES_MONITORING_PASSWORD}
     metrics:
       postgresql.blks_hit:
         enabled: true