Take the database password from PGPASSWORD, not the DSN #9

2026-09-20T09:06:46Z

niklas commented

2026-09-20 09:06:46 +00:00

Refs #2. Found while starting the wrapper chart, which is the first thing that actually has to wire this up.

The chart as merged asks for a whole DSN in a Secret. Nothing writes one. The Zalando postgres operator generates a Secret with username and password keys and no connection string, so using it would mean hand-maintaining a second copy of a password the operator owns and re-mints on a from-scratch rebuild — which is charts#176, the exact problem miniflux closed by doing the opposite.

So:

database.dsn is a plain value with no password in it.
database.passwordSecret supplies PGPASSWORD, pointed straight at the operator's Secret.

pgx fills in from libpq's PG* environment variables whatever the DSN omits, the same way miniflux's lib/pq does.

Verified, not assumed — the same check charts#176 records for miniflux, against a real server:

password-less DSN + correct PGPASSWORD → connects and serves;
same DSN + wrong PGPASSWORD → failed SASL auth: FATAL: password authentication failed for user "terdut" (SQLSTATE 28P01).

So the variable is doing the work rather than being silently ignored.

It also keeps the credential out of the rendered manifest and out of kubectl describe pod, which a DSN-with-password does not.

Needed before the wrapper chart in Ryuvia/charts can declare the postgresql CR, and therefore before the cutover.

Refs #2. Found while starting the wrapper chart, which is the first thing that actually has to wire this up. The chart as merged asks for a whole DSN in a Secret. **Nothing writes one.** The Zalando postgres operator generates a Secret with `username` and `password` keys and no connection string, so using it would mean hand-maintaining a second copy of a password the operator owns and re-mints on a from-scratch rebuild — which is charts#176, the exact problem miniflux closed by doing the opposite. So: - `database.dsn` is a plain value with no password in it. - `database.passwordSecret` supplies `PGPASSWORD`, pointed straight at the operator's Secret. pgx fills in from libpq's `PG*` environment variables whatever the DSN omits, the same way miniflux's lib/pq does. **Verified, not assumed** — the same check charts#176 records for miniflux, against a real server: - password-less DSN + correct `PGPASSWORD` → connects and serves; - same DSN + wrong `PGPASSWORD` → `failed SASL auth: FATAL: password authentication failed for user "terdut" (SQLSTATE 28P01)`. So the variable is doing the work rather than being silently ignored. It also keeps the credential out of the rendered manifest and out of `kubectl describe pod`, which a DSN-with-password does not. Needed before the wrapper chart in `Ryuvia/charts` can declare the `postgresql` CR, and therefore before the cutover.

niklas added 1 commit 2026-09-20 09:06:47 +00:00

Take the database password from PGPASSWORD, not the DSN

CI / test (pull_request) Successful in 4s

Details

CI / chart (pull_request) Successful in 1s

Details

CI / security (pull_request) Successful in 11s

Details

cc31c993dd

The chart asked for a whole DSN in a Secret. Nothing writes one: the
Zalando postgres operator generates a Secret with `username` and
`password` keys and no connection string, so wiring the wrapper chart up
would have meant hand-maintaining a second copy of a password the
operator owns and rotates on a from-scratch rebuild -- which is charts#176
again, the issue miniflux closed by doing the opposite.

So the DSN becomes a plain value with no password in it, and the password
arrives as PGPASSWORD from a Secret. pgx fills in from libpq's PG*
environment variables whatever the DSN omits, exactly as miniflux's
lib/pq does. Verified rather than assumed, against a real server: a
password-less DSN connects with PGPASSWORD set, and fails with
`password authentication failed` when it is wrong, so the variable is
doing the work rather than being quietly ignored.

It also keeps the credential out of the rendered manifest and out of
`kubectl describe pod`, which a DSN-with-password does not.

niklas merged commit cede8743a8 into main

2026-09-20 09:07:33 +00:00

niklas referenced this pull request

2026-09-25 09:55:35 +00:00

A dead man's switch incident cannot recover when its heartbeat moves to another team, and nothing says the switch is orphaned #22

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: niklas/terdut-server#9