From 2b188ef93409c145173a1a88e1325194e676d536 Mon Sep 17 00:00:00 2001 From: Yuriy Kirillov Date: Mon, 24 Aug 2026 20:16:06 +0200 Subject: [PATCH 01/10] fix: add rybbit's missing redis dependency, stop renaming clickhouse's default user Two config bugs found running the first real deploy on heimdall: 1. rybbit-backend hardcodes "default" as its ClickHouse username (no env var controls it - only CLICKHOUSE_HOST/DB/PASSWORD are configurable, confirmed against rybbit's own upstream docker-compose.yml). Our clickhouse-26.5.yml set CLICKHOUSE_USER=${APP_NAME}, which renames ClickHouse's built-in "default" user rather than adding a second one - so the user backend was actually trying to authenticate as no longer existed. Dropped CLICKHOUSE_USER (and the now-pointless CLICKHOUSE_DEFAULT_ACCESS_MANAGEMENT) from the template entirely. 2. rybbit-backend requires Redis (REDIS_HOST/REDIS_PORT/REDIS_PASSWORD) for session tracking and bot-anomaly counters - our compose file never had a redis service at all, so the backend was falling back to localhost:6379 and failing every request. Added a redis service (password-protected via --requirepass, reusing DATABASE_PASSWORD like postgres/clickhouse already do) and wired backend's depends_on to it. Co-Authored-By: Claude Sonnet 5 --- apps/clickhouse-26.5.yml | 2 -- apps/rybbit/docker-compose.yml | 20 +++++++++++++++++++- 2 files changed, 19 insertions(+), 3 deletions(-) diff --git a/apps/clickhouse-26.5.yml b/apps/clickhouse-26.5.yml index 5da0d74..9fb948d 100644 --- a/apps/clickhouse-26.5.yml +++ b/apps/clickhouse-26.5.yml @@ -4,9 +4,7 @@ services: restart: unless-stopped environment: CLICKHOUSE_DB: ${APP_NAME} - CLICKHOUSE_USER: ${APP_NAME} CLICKHOUSE_PASSWORD: ${DATABASE_PASSWORD} - CLICKHOUSE_DEFAULT_ACCESS_MANAGEMENT: 1 volumes: - ${DATA_DIR}/clickhouse/data:/var/lib/clickhouse - ${DATA_DIR}/clickhouse/logs:/var/log/clickhouse-server diff --git a/apps/rybbit/docker-compose.yml b/apps/rybbit/docker-compose.yml index 05d51d4..77f31a6 100644 --- a/apps/rybbit/docker-compose.yml +++ b/apps/rybbit/docker-compose.yml @@ -10,6 +10,7 @@ x-vault-env: &vault-env MAPBOX_TOKEN: ${MAPBOX_TOKEN:-} POSTGRES_PASSWORD: ${DATABASE_PASSWORD} CLICKHOUSE_PASSWORD: ${DATABASE_PASSWORD} + REDIS_PASSWORD: ${DATABASE_PASSWORD} x-internal-env: &internal-env NODE_ENV: production POSTGRES_HOST: postgres @@ -18,7 +19,8 @@ x-internal-env: &internal-env POSTGRES_USER: ${APP_NAME} CLICKHOUSE_HOST: http://clickhouse:8123 CLICKHOUSE_DB: ${APP_NAME} - CLICKHOUSE_USER: ${APP_NAME} + REDIS_HOST: redis + REDIS_PORT: 6379 services: client: image: ghcr.io/rybbit-io/rybbit-client @@ -51,9 +53,25 @@ services: condition: service_healthy postgres: condition: service_healthy + redis: + condition: service_healthy healthcheck: test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://127.0.0.1:3001/api/health"] start_period: 30s interval: 30s timeout: 5s retries: 5 + redis: + image: redis:8 + command: ["redis-server", "--requirepass", "${DATABASE_PASSWORD}"] + restart: unless-stopped + volumes: + - ${DATA_DIR}/redis:/data + healthcheck: + test: ["CMD", "redis-cli", "-a", "${DATABASE_PASSWORD}", "--no-auth-warning", "ping"] + start_period: 30s + interval: 30s + timeout: 5s + retries: 5 + networks: + - internal From 1402b422bbfb5f289490663d8a6ed87958554f1b Mon Sep 17 00:00:00 2001 From: Yuriy Kirillov Date: Mon, 24 Aug 2026 20:43:42 +0200 Subject: [PATCH 02/10] docs: document each shared database template's connection credentials Add a one-line comment above each template's environment: block stating exactly which user/password/database an app should connect with - prompted by the ClickHouse default-user bug just fixed, where the actual credentials weren't obvious from scanning the file. Also wires CLICKHOUSE_PASSWORD into clickhouse-25.4.yml (previously unset, so its default user had no network access at all) so the new comment is actually accurate - unused by any app today, but should behave the same as clickhouse-26.5.yml when something eventually picks it. Co-Authored-By: Claude Sonnet 5 --- apps/clickhouse-25.4.yml | 4 ++++ apps/clickhouse-26.5.yml | 3 +++ apps/mongodb-8.yml | 1 + apps/mysql-8.yml | 1 + apps/paradedb-17.yml | 1 + apps/pgvector-17.yml | 1 + apps/postgres-17.yml | 1 + apps/postgres-18.yml | 1 + apps/redis-7.yml | 1 + apps/redis-8.yml | 1 + apps/timescale-17.yml | 1 + 11 files changed, 16 insertions(+) diff --git a/apps/clickhouse-25.4.yml b/apps/clickhouse-25.4.yml index ad0b0e4..61c8604 100644 --- a/apps/clickhouse-25.4.yml +++ b/apps/clickhouse-25.4.yml @@ -2,8 +2,12 @@ services: clickhouse: image: clickhouse/clickhouse-server:25.4 restart: unless-stopped + # connect as user default (not ${APP_NAME} - CLICKHOUSE_USER renames the + # built-in default user rather than adding one, and some clients hardcode + # "default" with no way to override it), password ${DATABASE_PASSWORD}, database ${APP_NAME} environment: CLICKHOUSE_DB: ${APP_NAME} + CLICKHOUSE_PASSWORD: ${DATABASE_PASSWORD} volumes: - ${DATA_DIR}/clickhouse/data:/var/lib/clickhouse - ${DATA_DIR}/clickhouse/logs:/var/log/clickhouse-server diff --git a/apps/clickhouse-26.5.yml b/apps/clickhouse-26.5.yml index 9fb948d..0e326fd 100644 --- a/apps/clickhouse-26.5.yml +++ b/apps/clickhouse-26.5.yml @@ -2,6 +2,9 @@ services: clickhouse: image: clickhouse/clickhouse-server:26.5 restart: unless-stopped + # connect as user default (not ${APP_NAME} - CLICKHOUSE_USER renames the + # built-in default user rather than adding one, and some clients hardcode + # "default" with no way to override it), password ${DATABASE_PASSWORD}, database ${APP_NAME} environment: CLICKHOUSE_DB: ${APP_NAME} CLICKHOUSE_PASSWORD: ${DATABASE_PASSWORD} diff --git a/apps/mongodb-8.yml b/apps/mongodb-8.yml index 1dc1816..5919fef 100644 --- a/apps/mongodb-8.yml +++ b/apps/mongodb-8.yml @@ -2,6 +2,7 @@ services: mongodb: image: bitnami/mongodb restart: unless-stopped + # connect as user ${APP_NAME}, password ${DATABASE_PASSWORD}, database ${APP_NAME} (root password is also ${DATABASE_PASSWORD}) environment: MONGODB_ROOT_PASSWORD: ${DATABASE_PASSWORD} MONGODB_USERNAME: ${APP_NAME} diff --git a/apps/mysql-8.yml b/apps/mysql-8.yml index e1e13ce..ba3ca95 100644 --- a/apps/mysql-8.yml +++ b/apps/mysql-8.yml @@ -2,6 +2,7 @@ services: mysql: image: mysql:8 restart: unless-stopped + # connect as user ${APP_NAME}, password ${DATABASE_PASSWORD}, database ${APP_NAME} (root password is also ${DATABASE_PASSWORD}) environment: MYSQL_DATABASE: ${APP_NAME} MYSQL_USER: ${APP_NAME} diff --git a/apps/paradedb-17.yml b/apps/paradedb-17.yml index 1cf351c..459eea1 100644 --- a/apps/paradedb-17.yml +++ b/apps/paradedb-17.yml @@ -3,6 +3,7 @@ services: image: paradedb/paradedb:latest-pg17 restart: unless-stopped command: ["postgres", "-c", "log_min_messages=ERROR", "-c", "client_min_messages=ERROR"] + # connect as user ${APP_NAME}, password ${DATABASE_PASSWORD}, database ${APP_NAME} environment: POSTGRES_DB: ${APP_NAME} POSTGRES_PASSWORD: ${DATABASE_PASSWORD} diff --git a/apps/pgvector-17.yml b/apps/pgvector-17.yml index fd486d3..344c76e 100644 --- a/apps/pgvector-17.yml +++ b/apps/pgvector-17.yml @@ -3,6 +3,7 @@ services: image: pgvector/pgvector:pg17 restart: unless-stopped command: ["postgres", "-c", "log_min_messages=ERROR", "-c", "client_min_messages=ERROR"] + # connect as user ${APP_NAME}, password ${DATABASE_PASSWORD}, database ${APP_NAME} environment: POSTGRES_DB: ${APP_NAME} POSTGRES_PASSWORD: ${DATABASE_PASSWORD} diff --git a/apps/postgres-17.yml b/apps/postgres-17.yml index e54305d..5eeaca1 100644 --- a/apps/postgres-17.yml +++ b/apps/postgres-17.yml @@ -3,6 +3,7 @@ services: image: postgres:17 restart: unless-stopped command: ["postgres", "-c", "log_min_messages=ERROR", "-c", "client_min_messages=ERROR"] + # connect as user ${APP_NAME}, password ${DATABASE_PASSWORD}, database ${APP_NAME} environment: POSTGRES_DB: ${APP_NAME} POSTGRES_PASSWORD: ${DATABASE_PASSWORD} diff --git a/apps/postgres-18.yml b/apps/postgres-18.yml index 9170443..64bbfc7 100644 --- a/apps/postgres-18.yml +++ b/apps/postgres-18.yml @@ -3,6 +3,7 @@ services: image: postgres:18 restart: unless-stopped command: ["postgres", "-c", "log_min_messages=ERROR", "-c", "client_min_messages=ERROR"] + # connect as user ${APP_NAME}, password ${DATABASE_PASSWORD}, database ${APP_NAME} environment: POSTGRES_DB: ${APP_NAME} POSTGRES_PASSWORD: ${DATABASE_PASSWORD} diff --git a/apps/redis-7.yml b/apps/redis-7.yml index 3be1602..6e4bd67 100644 --- a/apps/redis-7.yml +++ b/apps/redis-7.yml @@ -2,6 +2,7 @@ services: redis: image: redis:7 restart: unless-stopped + # no auth configured - reachable at redis:6379 from any service on the internal network volumes: - ${DATA_DIR}/redis:/data healthcheck: diff --git a/apps/redis-8.yml b/apps/redis-8.yml index 4c14743..27e6ec7 100644 --- a/apps/redis-8.yml +++ b/apps/redis-8.yml @@ -2,6 +2,7 @@ services: redis: image: redis:8 restart: unless-stopped + # no auth configured - reachable at redis:6379 from any service on the internal network volumes: - ${DATA_DIR}/redis:/data healthcheck: diff --git a/apps/timescale-17.yml b/apps/timescale-17.yml index 0c20e5f..e0efe38 100644 --- a/apps/timescale-17.yml +++ b/apps/timescale-17.yml @@ -2,6 +2,7 @@ services: timescale: image: timescale/timescaledb:latest-pg17 restart: unless-stopped + # connect as user ${APP_NAME}, password ${DATABASE_PASSWORD}, database ${APP_NAME} environment: POSTGRES_DB: ${APP_NAME} POSTGRES_USER: ${APP_NAME} From c7ccd2aa9c50ea7bca04ebad17862bfa0870d18b Mon Sep 17 00:00:00 2001 From: Yuriy Kirillov Date: Mon, 24 Aug 2026 20:45:06 +0200 Subject: [PATCH 03/10] refactor: move connection-credentials comments to file header Read better as the first thing you see when opening one of these templates, rather than buried mid-service next to environment:. Co-Authored-By: Claude Sonnet 5 --- apps/clickhouse-25.4.yml | 6 +++--- apps/clickhouse-26.5.yml | 6 +++--- apps/mongodb-8.yml | 2 +- apps/mysql-8.yml | 2 +- apps/paradedb-17.yml | 2 +- apps/pgvector-17.yml | 2 +- apps/postgres-17.yml | 2 +- apps/postgres-18.yml | 2 +- apps/redis-7.yml | 2 +- apps/redis-8.yml | 2 +- apps/timescale-17.yml | 2 +- 11 files changed, 15 insertions(+), 15 deletions(-) diff --git a/apps/clickhouse-25.4.yml b/apps/clickhouse-25.4.yml index 61c8604..077882d 100644 --- a/apps/clickhouse-25.4.yml +++ b/apps/clickhouse-25.4.yml @@ -1,10 +1,10 @@ +# connect as user default (not ${APP_NAME} - CLICKHOUSE_USER renames the +# built-in default user rather than adding one, and some clients hardcode +# "default" with no way to override it), password ${DATABASE_PASSWORD}, database ${APP_NAME} services: clickhouse: image: clickhouse/clickhouse-server:25.4 restart: unless-stopped - # connect as user default (not ${APP_NAME} - CLICKHOUSE_USER renames the - # built-in default user rather than adding one, and some clients hardcode - # "default" with no way to override it), password ${DATABASE_PASSWORD}, database ${APP_NAME} environment: CLICKHOUSE_DB: ${APP_NAME} CLICKHOUSE_PASSWORD: ${DATABASE_PASSWORD} diff --git a/apps/clickhouse-26.5.yml b/apps/clickhouse-26.5.yml index 0e326fd..2a4ff57 100644 --- a/apps/clickhouse-26.5.yml +++ b/apps/clickhouse-26.5.yml @@ -1,10 +1,10 @@ +# connect as user default (not ${APP_NAME} - CLICKHOUSE_USER renames the +# built-in default user rather than adding one, and some clients hardcode +# "default" with no way to override it), password ${DATABASE_PASSWORD}, database ${APP_NAME} services: clickhouse: image: clickhouse/clickhouse-server:26.5 restart: unless-stopped - # connect as user default (not ${APP_NAME} - CLICKHOUSE_USER renames the - # built-in default user rather than adding one, and some clients hardcode - # "default" with no way to override it), password ${DATABASE_PASSWORD}, database ${APP_NAME} environment: CLICKHOUSE_DB: ${APP_NAME} CLICKHOUSE_PASSWORD: ${DATABASE_PASSWORD} diff --git a/apps/mongodb-8.yml b/apps/mongodb-8.yml index 5919fef..58312b9 100644 --- a/apps/mongodb-8.yml +++ b/apps/mongodb-8.yml @@ -1,8 +1,8 @@ +# connect as user ${APP_NAME}, password ${DATABASE_PASSWORD}, database ${APP_NAME} (root password is also ${DATABASE_PASSWORD}) services: mongodb: image: bitnami/mongodb restart: unless-stopped - # connect as user ${APP_NAME}, password ${DATABASE_PASSWORD}, database ${APP_NAME} (root password is also ${DATABASE_PASSWORD}) environment: MONGODB_ROOT_PASSWORD: ${DATABASE_PASSWORD} MONGODB_USERNAME: ${APP_NAME} diff --git a/apps/mysql-8.yml b/apps/mysql-8.yml index ba3ca95..3adc930 100644 --- a/apps/mysql-8.yml +++ b/apps/mysql-8.yml @@ -1,8 +1,8 @@ +# connect as user ${APP_NAME}, password ${DATABASE_PASSWORD}, database ${APP_NAME} (root password is also ${DATABASE_PASSWORD}) services: mysql: image: mysql:8 restart: unless-stopped - # connect as user ${APP_NAME}, password ${DATABASE_PASSWORD}, database ${APP_NAME} (root password is also ${DATABASE_PASSWORD}) environment: MYSQL_DATABASE: ${APP_NAME} MYSQL_USER: ${APP_NAME} diff --git a/apps/paradedb-17.yml b/apps/paradedb-17.yml index 459eea1..05ee77f 100644 --- a/apps/paradedb-17.yml +++ b/apps/paradedb-17.yml @@ -1,9 +1,9 @@ +# connect as user ${APP_NAME}, password ${DATABASE_PASSWORD}, database ${APP_NAME} services: paradedb: image: paradedb/paradedb:latest-pg17 restart: unless-stopped command: ["postgres", "-c", "log_min_messages=ERROR", "-c", "client_min_messages=ERROR"] - # connect as user ${APP_NAME}, password ${DATABASE_PASSWORD}, database ${APP_NAME} environment: POSTGRES_DB: ${APP_NAME} POSTGRES_PASSWORD: ${DATABASE_PASSWORD} diff --git a/apps/pgvector-17.yml b/apps/pgvector-17.yml index 344c76e..2521492 100644 --- a/apps/pgvector-17.yml +++ b/apps/pgvector-17.yml @@ -1,9 +1,9 @@ +# connect as user ${APP_NAME}, password ${DATABASE_PASSWORD}, database ${APP_NAME} services: pgvector: image: pgvector/pgvector:pg17 restart: unless-stopped command: ["postgres", "-c", "log_min_messages=ERROR", "-c", "client_min_messages=ERROR"] - # connect as user ${APP_NAME}, password ${DATABASE_PASSWORD}, database ${APP_NAME} environment: POSTGRES_DB: ${APP_NAME} POSTGRES_PASSWORD: ${DATABASE_PASSWORD} diff --git a/apps/postgres-17.yml b/apps/postgres-17.yml index 5eeaca1..0b43d47 100644 --- a/apps/postgres-17.yml +++ b/apps/postgres-17.yml @@ -1,9 +1,9 @@ +# connect as user ${APP_NAME}, password ${DATABASE_PASSWORD}, database ${APP_NAME} services: postgres: image: postgres:17 restart: unless-stopped command: ["postgres", "-c", "log_min_messages=ERROR", "-c", "client_min_messages=ERROR"] - # connect as user ${APP_NAME}, password ${DATABASE_PASSWORD}, database ${APP_NAME} environment: POSTGRES_DB: ${APP_NAME} POSTGRES_PASSWORD: ${DATABASE_PASSWORD} diff --git a/apps/postgres-18.yml b/apps/postgres-18.yml index 64bbfc7..8eab54e 100644 --- a/apps/postgres-18.yml +++ b/apps/postgres-18.yml @@ -1,9 +1,9 @@ +# connect as user ${APP_NAME}, password ${DATABASE_PASSWORD}, database ${APP_NAME} services: postgres: image: postgres:18 restart: unless-stopped command: ["postgres", "-c", "log_min_messages=ERROR", "-c", "client_min_messages=ERROR"] - # connect as user ${APP_NAME}, password ${DATABASE_PASSWORD}, database ${APP_NAME} environment: POSTGRES_DB: ${APP_NAME} POSTGRES_PASSWORD: ${DATABASE_PASSWORD} diff --git a/apps/redis-7.yml b/apps/redis-7.yml index 6e4bd67..2575ee3 100644 --- a/apps/redis-7.yml +++ b/apps/redis-7.yml @@ -1,8 +1,8 @@ +# no auth configured - reachable at redis:6379 from any service on the internal network services: redis: image: redis:7 restart: unless-stopped - # no auth configured - reachable at redis:6379 from any service on the internal network volumes: - ${DATA_DIR}/redis:/data healthcheck: diff --git a/apps/redis-8.yml b/apps/redis-8.yml index 27e6ec7..d6632e5 100644 --- a/apps/redis-8.yml +++ b/apps/redis-8.yml @@ -1,8 +1,8 @@ +# no auth configured - reachable at redis:6379 from any service on the internal network services: redis: image: redis:8 restart: unless-stopped - # no auth configured - reachable at redis:6379 from any service on the internal network volumes: - ${DATA_DIR}/redis:/data healthcheck: diff --git a/apps/timescale-17.yml b/apps/timescale-17.yml index e0efe38..43e86c4 100644 --- a/apps/timescale-17.yml +++ b/apps/timescale-17.yml @@ -1,8 +1,8 @@ +# connect as user ${APP_NAME}, password ${DATABASE_PASSWORD}, database ${APP_NAME} services: timescale: image: timescale/timescaledb:latest-pg17 restart: unless-stopped - # connect as user ${APP_NAME}, password ${DATABASE_PASSWORD}, database ${APP_NAME} environment: POSTGRES_DB: ${APP_NAME} POSTGRES_USER: ${APP_NAME} From 5806f2f03f2d09b2bedff136e88387389703d571 Mon Sep 17 00:00:00 2001 From: Yuriy Kirillov Date: Mon, 24 Aug 2026 20:47:53 +0200 Subject: [PATCH 04/10] refactor: reuse the shared redis-8.yml template for rybbit's redis include it like postgres/clickhouse already are, override only command/healthcheck locally for --requirepass auth - image, volumes, restart, and networks now come from the shared template instead of being duplicated. Co-Authored-By: Claude Sonnet 5 --- apps/rybbit/docker-compose.yml | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) diff --git a/apps/rybbit/docker-compose.yml b/apps/rybbit/docker-compose.yml index 77f31a6..b95378d 100644 --- a/apps/rybbit/docker-compose.yml +++ b/apps/rybbit/docker-compose.yml @@ -2,6 +2,7 @@ include: - ../networks.yml - ../postgres-18.yml - ../clickhouse-26.5.yml + - ../redis-8.yml x-vault-env: &vault-env BASE_URL: https://${APP_NAME}.${DOMAIN} BETTER_AUTH_SECRET: ${SESSION_KEY} @@ -62,16 +63,10 @@ services: timeout: 5s retries: 5 redis: - image: redis:8 command: ["redis-server", "--requirepass", "${DATABASE_PASSWORD}"] - restart: unless-stopped - volumes: - - ${DATA_DIR}/redis:/data healthcheck: test: ["CMD", "redis-cli", "-a", "${DATABASE_PASSWORD}", "--no-auth-warning", "ping"] start_period: 30s interval: 30s timeout: 5s retries: 5 - networks: - - internal From 901b3a7efc4bf358cd1f093ec2d602195326fd98 Mon Sep 17 00:00:00 2001 From: Yuriy Kirillov Date: Mon, 24 Aug 2026 20:51:20 +0200 Subject: [PATCH 05/10] refactor: drop redis auth for rybbit - the client already skips it when unset server/src/db/redis/redis.ts conditionally spreads password into the ioredis config only when REDIS_PASSWORD is set - confirmed against rybbit's actual source, unlike ClickHouse's client this one genuinely supports running without auth. Redis is internal-network-only, no different exposure than postgres/clickhouse would have without a password, so the plain include with no local override is enough. Co-Authored-By: Claude Sonnet 5 --- apps/rybbit/docker-compose.yml | 9 --------- 1 file changed, 9 deletions(-) diff --git a/apps/rybbit/docker-compose.yml b/apps/rybbit/docker-compose.yml index b95378d..7892dff 100644 --- a/apps/rybbit/docker-compose.yml +++ b/apps/rybbit/docker-compose.yml @@ -11,7 +11,6 @@ x-vault-env: &vault-env MAPBOX_TOKEN: ${MAPBOX_TOKEN:-} POSTGRES_PASSWORD: ${DATABASE_PASSWORD} CLICKHOUSE_PASSWORD: ${DATABASE_PASSWORD} - REDIS_PASSWORD: ${DATABASE_PASSWORD} x-internal-env: &internal-env NODE_ENV: production POSTGRES_HOST: postgres @@ -62,11 +61,3 @@ services: interval: 30s timeout: 5s retries: 5 - redis: - command: ["redis-server", "--requirepass", "${DATABASE_PASSWORD}"] - healthcheck: - test: ["CMD", "redis-cli", "-a", "${DATABASE_PASSWORD}", "--no-auth-warning", "ping"] - start_period: 30s - interval: 30s - timeout: 5s - retries: 5 From 77fb95872fd154b4e722b2f3c34ba6b67e208d10 Mon Sep 17 00:00:00 2001 From: Yuriy Kirillov Date: Mon, 24 Aug 2026 20:56:30 +0200 Subject: [PATCH 06/10] feat: require a password on the shared redis templates First step of normalizing every shared database template to the same target state: use the engine's own default user (root for MySQL, default for ClickHouse/Redis, postgres for Postgres), password it with DATABASE_PASSWORD, refuse unauthenticated connections - never create a separate ${APP_NAME} user. Redis was the one holdout with no auth at all; --requirepass now brings it in line with postgres/mysql/mongo/ clickhouse, all of which already required a password. Reverts the previous "drop redis auth for rybbit" commit's reasoning - that was a per-app optimization that made sense for rybbit's client alone, but conflicts with treating "always require a password" as a property of the shared template itself, not a per-consumer choice. REDIS_PASSWORD is back in rybbit's vault-env; the shared template now carries the auth requirement so rybbit needs zero local overrides. Postgres/MySQL/MongoDB still create an ${APP_NAME} user for now - follow-up work, not done here. Co-Authored-By: Claude Sonnet 5 --- apps/redis-7.yml | 5 +++-- apps/redis-8.yml | 5 +++-- apps/rybbit/docker-compose.yml | 1 + 3 files changed, 7 insertions(+), 4 deletions(-) diff --git a/apps/redis-7.yml b/apps/redis-7.yml index 2575ee3..bcdb126 100644 --- a/apps/redis-7.yml +++ b/apps/redis-7.yml @@ -1,12 +1,13 @@ -# no auth configured - reachable at redis:6379 from any service on the internal network +# connect as user default, password ${DATABASE_PASSWORD} services: redis: image: redis:7 + command: ["redis-server", "--requirepass", "${DATABASE_PASSWORD}"] restart: unless-stopped volumes: - ${DATA_DIR}/redis:/data healthcheck: - test: ["CMD", "redis-cli", "ping"] + test: ["CMD", "redis-cli", "-a", "${DATABASE_PASSWORD}", "--no-auth-warning", "ping"] start_period: 30s interval: 30s timeout: 5s diff --git a/apps/redis-8.yml b/apps/redis-8.yml index d6632e5..6ff146a 100644 --- a/apps/redis-8.yml +++ b/apps/redis-8.yml @@ -1,12 +1,13 @@ -# no auth configured - reachable at redis:6379 from any service on the internal network +# connect as user default, password ${DATABASE_PASSWORD} services: redis: image: redis:8 + command: ["redis-server", "--requirepass", "${DATABASE_PASSWORD}"] restart: unless-stopped volumes: - ${DATA_DIR}/redis:/data healthcheck: - test: ["CMD", "redis-cli", "ping"] + test: ["CMD", "redis-cli", "-a", "${DATABASE_PASSWORD}", "--no-auth-warning", "ping"] start_period: 30s interval: 30s timeout: 5s diff --git a/apps/rybbit/docker-compose.yml b/apps/rybbit/docker-compose.yml index 7892dff..33b3098 100644 --- a/apps/rybbit/docker-compose.yml +++ b/apps/rybbit/docker-compose.yml @@ -11,6 +11,7 @@ x-vault-env: &vault-env MAPBOX_TOKEN: ${MAPBOX_TOKEN:-} POSTGRES_PASSWORD: ${DATABASE_PASSWORD} CLICKHOUSE_PASSWORD: ${DATABASE_PASSWORD} + REDIS_PASSWORD: ${DATABASE_PASSWORD} x-internal-env: &internal-env NODE_ENV: production POSTGRES_HOST: postgres From 4644d04e7fc019f038b9e86893236a3518210f1b Mon Sep 17 00:00:00 2001 From: Yuriy Kirillov Date: Mon, 24 Aug 2026 20:58:03 +0200 Subject: [PATCH 07/10] docs: add port to each shared template's connection-credentials comment Co-Authored-By: Claude Sonnet 5 --- apps/clickhouse-25.4.yml | 3 ++- apps/clickhouse-26.5.yml | 3 ++- apps/mongodb-8.yml | 2 +- apps/mysql-8.yml | 2 +- apps/paradedb-17.yml | 2 +- apps/pgvector-17.yml | 2 +- apps/postgres-17.yml | 2 +- apps/postgres-18.yml | 2 +- apps/redis-7.yml | 2 +- apps/redis-8.yml | 2 +- apps/timescale-17.yml | 2 +- 11 files changed, 13 insertions(+), 11 deletions(-) diff --git a/apps/clickhouse-25.4.yml b/apps/clickhouse-25.4.yml index 077882d..8c62f91 100644 --- a/apps/clickhouse-25.4.yml +++ b/apps/clickhouse-25.4.yml @@ -1,6 +1,7 @@ # connect as user default (not ${APP_NAME} - CLICKHOUSE_USER renames the # built-in default user rather than adding one, and some clients hardcode -# "default" with no way to override it), password ${DATABASE_PASSWORD}, database ${APP_NAME} +# "default" with no way to override it), password ${DATABASE_PASSWORD}, +# database ${APP_NAME}, port 8123 (HTTP; native protocol is 9000) services: clickhouse: image: clickhouse/clickhouse-server:25.4 diff --git a/apps/clickhouse-26.5.yml b/apps/clickhouse-26.5.yml index 2a4ff57..245ae6a 100644 --- a/apps/clickhouse-26.5.yml +++ b/apps/clickhouse-26.5.yml @@ -1,6 +1,7 @@ # connect as user default (not ${APP_NAME} - CLICKHOUSE_USER renames the # built-in default user rather than adding one, and some clients hardcode -# "default" with no way to override it), password ${DATABASE_PASSWORD}, database ${APP_NAME} +# "default" with no way to override it), password ${DATABASE_PASSWORD}, +# database ${APP_NAME}, port 8123 (HTTP; native protocol is 9000) services: clickhouse: image: clickhouse/clickhouse-server:26.5 diff --git a/apps/mongodb-8.yml b/apps/mongodb-8.yml index 58312b9..fb7487f 100644 --- a/apps/mongodb-8.yml +++ b/apps/mongodb-8.yml @@ -1,4 +1,4 @@ -# connect as user ${APP_NAME}, password ${DATABASE_PASSWORD}, database ${APP_NAME} (root password is also ${DATABASE_PASSWORD}) +# connect as user ${APP_NAME}, password ${DATABASE_PASSWORD}, database ${APP_NAME}, port 27017 (root password is also ${DATABASE_PASSWORD}) services: mongodb: image: bitnami/mongodb diff --git a/apps/mysql-8.yml b/apps/mysql-8.yml index 3adc930..8fe14e6 100644 --- a/apps/mysql-8.yml +++ b/apps/mysql-8.yml @@ -1,4 +1,4 @@ -# connect as user ${APP_NAME}, password ${DATABASE_PASSWORD}, database ${APP_NAME} (root password is also ${DATABASE_PASSWORD}) +# connect as user ${APP_NAME}, password ${DATABASE_PASSWORD}, database ${APP_NAME}, port 3306 (root password is also ${DATABASE_PASSWORD}) services: mysql: image: mysql:8 diff --git a/apps/paradedb-17.yml b/apps/paradedb-17.yml index 05ee77f..efa1977 100644 --- a/apps/paradedb-17.yml +++ b/apps/paradedb-17.yml @@ -1,4 +1,4 @@ -# connect as user ${APP_NAME}, password ${DATABASE_PASSWORD}, database ${APP_NAME} +# connect as user ${APP_NAME}, password ${DATABASE_PASSWORD}, database ${APP_NAME}, port 5432 services: paradedb: image: paradedb/paradedb:latest-pg17 diff --git a/apps/pgvector-17.yml b/apps/pgvector-17.yml index 2521492..cab2341 100644 --- a/apps/pgvector-17.yml +++ b/apps/pgvector-17.yml @@ -1,4 +1,4 @@ -# connect as user ${APP_NAME}, password ${DATABASE_PASSWORD}, database ${APP_NAME} +# connect as user ${APP_NAME}, password ${DATABASE_PASSWORD}, database ${APP_NAME}, port 5432 services: pgvector: image: pgvector/pgvector:pg17 diff --git a/apps/postgres-17.yml b/apps/postgres-17.yml index 0b43d47..a92aaf2 100644 --- a/apps/postgres-17.yml +++ b/apps/postgres-17.yml @@ -1,4 +1,4 @@ -# connect as user ${APP_NAME}, password ${DATABASE_PASSWORD}, database ${APP_NAME} +# connect as user ${APP_NAME}, password ${DATABASE_PASSWORD}, database ${APP_NAME}, port 5432 services: postgres: image: postgres:17 diff --git a/apps/postgres-18.yml b/apps/postgres-18.yml index 8eab54e..a5b40c1 100644 --- a/apps/postgres-18.yml +++ b/apps/postgres-18.yml @@ -1,4 +1,4 @@ -# connect as user ${APP_NAME}, password ${DATABASE_PASSWORD}, database ${APP_NAME} +# connect as user ${APP_NAME}, password ${DATABASE_PASSWORD}, database ${APP_NAME}, port 5432 services: postgres: image: postgres:18 diff --git a/apps/redis-7.yml b/apps/redis-7.yml index bcdb126..32fc133 100644 --- a/apps/redis-7.yml +++ b/apps/redis-7.yml @@ -1,4 +1,4 @@ -# connect as user default, password ${DATABASE_PASSWORD} +# connect as user default, password ${DATABASE_PASSWORD}, port 6379 services: redis: image: redis:7 diff --git a/apps/redis-8.yml b/apps/redis-8.yml index 6ff146a..3c5457a 100644 --- a/apps/redis-8.yml +++ b/apps/redis-8.yml @@ -1,4 +1,4 @@ -# connect as user default, password ${DATABASE_PASSWORD} +# connect as user default, password ${DATABASE_PASSWORD}, port 6379 services: redis: image: redis:8 diff --git a/apps/timescale-17.yml b/apps/timescale-17.yml index 43e86c4..87f86da 100644 --- a/apps/timescale-17.yml +++ b/apps/timescale-17.yml @@ -1,4 +1,4 @@ -# connect as user ${APP_NAME}, password ${DATABASE_PASSWORD}, database ${APP_NAME} +# connect as user ${APP_NAME}, password ${DATABASE_PASSWORD}, database ${APP_NAME}, port 5432 services: timescale: image: timescale/timescaledb:latest-pg17 From 6cec296e2398a69bc93a690314604a50e7b5f9d8 Mon Sep 17 00:00:00 2001 From: Yuriy Kirillov Date: Mon, 24 Aug 2026 21:00:15 +0200 Subject: [PATCH 08/10] feat: normalize timescale-17.yml to the default postgres user Drop POSTGRES_USER: \${APP_NAME} - same target state as the other shared templates, use the engine's own default user (postgres) rather than creating a per-app one. Only codecov consumes this template today; updated its timeseries_database_url to connect as postgres instead of \${APP_NAME}. Also fixes a bug introduced by the earlier redis-7.yml/redis-8.yml auth change: codecov (the only consumer of redis-7.yml) had redis_url: "redis://redis:6379" with no password at all - now that the shared template requires one, that connection would have failed. Fixed to redis://:\${DATABASE_PASSWORD}@redis:6379. Not live anywhere yet (no vault exists for codecov), so nothing broke in production, but would have on first deploy. Co-Authored-By: Claude Sonnet 5 --- apps/codecov/codecov.yml.tpl | 4 ++-- apps/timescale-17.yml | 5 ++--- 2 files changed, 4 insertions(+), 5 deletions(-) diff --git a/apps/codecov/codecov.yml.tpl b/apps/codecov/codecov.yml.tpl index 92de082..734c9af 100644 --- a/apps/codecov/codecov.yml.tpl +++ b/apps/codecov/codecov.yml.tpl @@ -24,9 +24,9 @@ github: id: ${GITHUB_APP_ID} pem: /config/key.pem services: - redis_url: "redis://redis:6379" + redis_url: "redis://:${DATABASE_PASSWORD}@redis:6379" database_url: "postgres://${APP_NAME}:${DATABASE_PASSWORD}@postgres:5432/${APP_NAME}" - timeseries_database_url: "postgres://${APP_NAME}:${DATABASE_PASSWORD}@timescale:5432/${APP_NAME}" + timeseries_database_url: "postgres://postgres:${DATABASE_PASSWORD}@timescale:5432/${APP_NAME}" minio: host: ${S3_HOST} bucket: ${S3_BUCKET} diff --git a/apps/timescale-17.yml b/apps/timescale-17.yml index 87f86da..97c10e6 100644 --- a/apps/timescale-17.yml +++ b/apps/timescale-17.yml @@ -1,16 +1,15 @@ -# connect as user ${APP_NAME}, password ${DATABASE_PASSWORD}, database ${APP_NAME}, port 5432 +# connect as user postgres, password ${DATABASE_PASSWORD}, database ${APP_NAME}, port 5432 services: timescale: image: timescale/timescaledb:latest-pg17 restart: unless-stopped environment: POSTGRES_DB: ${APP_NAME} - POSTGRES_USER: ${APP_NAME} POSTGRES_PASSWORD: ${DATABASE_PASSWORD} volumes: - ${DATA_DIR}/timescale:/var/lib/postgresql/data healthcheck: - test: ["CMD", "pg_isready", "-d", "${APP_NAME}", "-U", "${APP_NAME}"] + test: ["CMD", "pg_isready", "-d", "${APP_NAME}", "-U", "postgres"] start_period: 30s interval: 30s timeout: 5s From 185f5bfa3d4e8aed913432bab4fe75a66e66b898 Mon Sep 17 00:00:00 2001 From: Yuriy Kirillov Date: Mon, 24 Aug 2026 21:01:49 +0200 Subject: [PATCH 09/10] docs: compress clickhouse header comment to one line, matching the other templates Co-Authored-By: Claude Sonnet 5 --- apps/clickhouse-25.4.yml | 5 +---- apps/clickhouse-26.5.yml | 5 +---- 2 files changed, 2 insertions(+), 8 deletions(-) diff --git a/apps/clickhouse-25.4.yml b/apps/clickhouse-25.4.yml index 8c62f91..901b37b 100644 --- a/apps/clickhouse-25.4.yml +++ b/apps/clickhouse-25.4.yml @@ -1,7 +1,4 @@ -# connect as user default (not ${APP_NAME} - CLICKHOUSE_USER renames the -# built-in default user rather than adding one, and some clients hardcode -# "default" with no way to override it), password ${DATABASE_PASSWORD}, -# database ${APP_NAME}, port 8123 (HTTP; native protocol is 9000) +# connect as user default, password ${DATABASE_PASSWORD}, database ${APP_NAME}, port 8123 (HTTP; native protocol is 9000) services: clickhouse: image: clickhouse/clickhouse-server:25.4 diff --git a/apps/clickhouse-26.5.yml b/apps/clickhouse-26.5.yml index 245ae6a..868754f 100644 --- a/apps/clickhouse-26.5.yml +++ b/apps/clickhouse-26.5.yml @@ -1,7 +1,4 @@ -# connect as user default (not ${APP_NAME} - CLICKHOUSE_USER renames the -# built-in default user rather than adding one, and some clients hardcode -# "default" with no way to override it), password ${DATABASE_PASSWORD}, -# database ${APP_NAME}, port 8123 (HTTP; native protocol is 9000) +# connect as user default, password ${DATABASE_PASSWORD}, database ${APP_NAME}, port 8123 (HTTP; native protocol is 9000) services: clickhouse: image: clickhouse/clickhouse-server:26.5 From cab1ead4f38fd974aea1a60ea7f48dd7ca353bf4 Mon Sep 17 00:00:00 2001 From: Yuriy Kirillov Date: Mon, 24 Aug 2026 21:06:31 +0200 Subject: [PATCH 10/10] feat: normalize remaining shared DB templates to their engine's default user Postgres-flavored templates (postgres-17/18, pgvector-17, paradedb-17) now connect as postgres instead of creating \${APP_NAME}; MySQL and MongoDB now connect as root instead of creating a scoped \${APP_NAME} user (both unused by any app today, changed for consistency with the rest of the catalog). Updates every consumer of the postgres templates to match: gatus's global.yml env-substitutes \${POSTGRES_USER} at runtime (not one of our own .tpl files), semaphore's SEMAPHORE_DB_USER, glitchtip's DATABASE_URL, rybbit's POSTGRES_USER, and codecov's database_url in codecov.yml.tpl. Completes the normalization started with redis-7/8.yml and timescale-17.yml: every shared DB template now uses its engine's own default user, password-protected, with the app's own name reserved just for the database itself. Co-Authored-By: Claude Sonnet 5 --- apps/codecov/codecov.yml.tpl | 2 +- apps/gatus/docker-compose.yml | 2 +- apps/glitchtip/docker-compose.yml | 2 +- apps/mongodb-8.yml | 4 +--- apps/mysql-8.yml | 4 +--- apps/paradedb-17.yml | 5 ++--- apps/pgvector-17.yml | 5 ++--- apps/postgres-17.yml | 5 ++--- apps/postgres-18.yml | 5 ++--- apps/rybbit/docker-compose.yml | 2 +- apps/semaphore/docker-compose.yml | 2 +- 11 files changed, 15 insertions(+), 23 deletions(-) diff --git a/apps/codecov/codecov.yml.tpl b/apps/codecov/codecov.yml.tpl index 734c9af..74c76ab 100644 --- a/apps/codecov/codecov.yml.tpl +++ b/apps/codecov/codecov.yml.tpl @@ -25,7 +25,7 @@ github: pem: /config/key.pem services: redis_url: "redis://:${DATABASE_PASSWORD}@redis:6379" - database_url: "postgres://${APP_NAME}:${DATABASE_PASSWORD}@postgres:5432/${APP_NAME}" + database_url: "postgres://postgres:${DATABASE_PASSWORD}@postgres:5432/${APP_NAME}" timeseries_database_url: "postgres://postgres:${DATABASE_PASSWORD}@timescale:5432/${APP_NAME}" minio: host: ${S3_HOST} diff --git a/apps/gatus/docker-compose.yml b/apps/gatus/docker-compose.yml index 6b7ca1e..720e222 100644 --- a/apps/gatus/docker-compose.yml +++ b/apps/gatus/docker-compose.yml @@ -8,7 +8,7 @@ x-vault-env: &vault-env TELEGRAM_ID: ${TELEGRAM_CHAT} x-internal-env: &internal-env GATUS_CONFIG_PATH: /config/yml - POSTGRES_USER: ${APP_NAME} + POSTGRES_USER: postgres POSTGRES_DB: ${APP_NAME} services: gatus: diff --git a/apps/glitchtip/docker-compose.yml b/apps/glitchtip/docker-compose.yml index d3c3ec7..9d63618 100644 --- a/apps/glitchtip/docker-compose.yml +++ b/apps/glitchtip/docker-compose.yml @@ -4,7 +4,7 @@ include: - ../redis-8.yml x-image: &image glitchtip/glitchtip x-vault-env: &vault-env - DATABASE_URL: postgresql://${APP_NAME}:${DATABASE_PASSWORD}@postgres:5432/${APP_NAME} + DATABASE_URL: postgresql://postgres:${DATABASE_PASSWORD}@postgres:5432/${APP_NAME} SECRET_KEY: ${SESSION_KEY} EMAIL_URL: ${EMAIL_URL:-consolemail://} GLITCHTIP_DOMAIN: https://${APP_NAME}.${DOMAIN} diff --git a/apps/mongodb-8.yml b/apps/mongodb-8.yml index fb7487f..2b773a7 100644 --- a/apps/mongodb-8.yml +++ b/apps/mongodb-8.yml @@ -1,12 +1,10 @@ -# connect as user ${APP_NAME}, password ${DATABASE_PASSWORD}, database ${APP_NAME}, port 27017 (root password is also ${DATABASE_PASSWORD}) +# connect as user root, password ${DATABASE_PASSWORD}, database ${APP_NAME}, port 27017 services: mongodb: image: bitnami/mongodb restart: unless-stopped environment: MONGODB_ROOT_PASSWORD: ${DATABASE_PASSWORD} - MONGODB_USERNAME: ${APP_NAME} - MONGODB_PASSWORD: ${DATABASE_PASSWORD} MONGODB_DATABASE: ${APP_NAME} volumes: - ${DATA_DIR}/mongodb:/bitnami/mongodb diff --git a/apps/mysql-8.yml b/apps/mysql-8.yml index 8fe14e6..321eede 100644 --- a/apps/mysql-8.yml +++ b/apps/mysql-8.yml @@ -1,12 +1,10 @@ -# connect as user ${APP_NAME}, password ${DATABASE_PASSWORD}, database ${APP_NAME}, port 3306 (root password is also ${DATABASE_PASSWORD}) +# connect as user root, password ${DATABASE_PASSWORD}, database ${APP_NAME}, port 3306 services: mysql: image: mysql:8 restart: unless-stopped environment: MYSQL_DATABASE: ${APP_NAME} - MYSQL_USER: ${APP_NAME} - MYSQL_PASSWORD: ${DATABASE_PASSWORD} MYSQL_ROOT_PASSWORD: ${DATABASE_PASSWORD} volumes: - ${DATA_DIR}/mysql:/var/lib/mysql diff --git a/apps/paradedb-17.yml b/apps/paradedb-17.yml index efa1977..a6ce0f1 100644 --- a/apps/paradedb-17.yml +++ b/apps/paradedb-17.yml @@ -1,4 +1,4 @@ -# connect as user ${APP_NAME}, password ${DATABASE_PASSWORD}, database ${APP_NAME}, port 5432 +# connect as user postgres, password ${DATABASE_PASSWORD}, database ${APP_NAME}, port 5432 services: paradedb: image: paradedb/paradedb:latest-pg17 @@ -7,11 +7,10 @@ services: environment: POSTGRES_DB: ${APP_NAME} POSTGRES_PASSWORD: ${DATABASE_PASSWORD} - POSTGRES_USER: ${APP_NAME} volumes: - ${DATA_DIR}/paradedb:/var/lib/postgresql/data healthcheck: - test: ["CMD", "pg_isready", "-d", "${APP_NAME}", "-U", "${APP_NAME}"] + test: ["CMD", "pg_isready", "-d", "${APP_NAME}", "-U", "postgres"] start_period: 30s interval: 30s timeout: 5s diff --git a/apps/pgvector-17.yml b/apps/pgvector-17.yml index cab2341..0c3dce1 100644 --- a/apps/pgvector-17.yml +++ b/apps/pgvector-17.yml @@ -1,4 +1,4 @@ -# connect as user ${APP_NAME}, password ${DATABASE_PASSWORD}, database ${APP_NAME}, port 5432 +# connect as user postgres, password ${DATABASE_PASSWORD}, database ${APP_NAME}, port 5432 services: pgvector: image: pgvector/pgvector:pg17 @@ -7,11 +7,10 @@ services: environment: POSTGRES_DB: ${APP_NAME} POSTGRES_PASSWORD: ${DATABASE_PASSWORD} - POSTGRES_USER: ${APP_NAME} volumes: - ${DATA_DIR}/pgvector:/var/lib/postgresql/data healthcheck: - test: ["CMD", "pg_isready", "-d", "${APP_NAME}", "-U", "${APP_NAME}"] + test: ["CMD", "pg_isready", "-d", "${APP_NAME}", "-U", "postgres"] start_period: 30s interval: 30s timeout: 5s diff --git a/apps/postgres-17.yml b/apps/postgres-17.yml index a92aaf2..72714b7 100644 --- a/apps/postgres-17.yml +++ b/apps/postgres-17.yml @@ -1,4 +1,4 @@ -# connect as user ${APP_NAME}, password ${DATABASE_PASSWORD}, database ${APP_NAME}, port 5432 +# connect as user postgres, password ${DATABASE_PASSWORD}, database ${APP_NAME}, port 5432 services: postgres: image: postgres:17 @@ -7,11 +7,10 @@ services: environment: POSTGRES_DB: ${APP_NAME} POSTGRES_PASSWORD: ${DATABASE_PASSWORD} - POSTGRES_USER: ${APP_NAME} volumes: - ${DATA_DIR}/postgres:/var/lib/postgresql/data healthcheck: - test: ["CMD", "pg_isready", "-d", "${APP_NAME}", "-U", "${APP_NAME}"] + test: ["CMD", "pg_isready", "-d", "${APP_NAME}", "-U", "postgres"] start_period: 30s interval: 30s timeout: 5s diff --git a/apps/postgres-18.yml b/apps/postgres-18.yml index a5b40c1..1d27ce8 100644 --- a/apps/postgres-18.yml +++ b/apps/postgres-18.yml @@ -1,4 +1,4 @@ -# connect as user ${APP_NAME}, password ${DATABASE_PASSWORD}, database ${APP_NAME}, port 5432 +# connect as user postgres, password ${DATABASE_PASSWORD}, database ${APP_NAME}, port 5432 services: postgres: image: postgres:18 @@ -7,11 +7,10 @@ services: environment: POSTGRES_DB: ${APP_NAME} POSTGRES_PASSWORD: ${DATABASE_PASSWORD} - POSTGRES_USER: ${APP_NAME} volumes: - ${DATA_DIR}/postgres:/var/lib/postgresql healthcheck: - test: ["CMD", "pg_isready", "-d", "${APP_NAME}", "-U", "${APP_NAME}"] + test: ["CMD", "pg_isready", "-d", "${APP_NAME}", "-U", "postgres"] start_period: 30s interval: 30s timeout: 5s diff --git a/apps/rybbit/docker-compose.yml b/apps/rybbit/docker-compose.yml index 33b3098..b3fcb80 100644 --- a/apps/rybbit/docker-compose.yml +++ b/apps/rybbit/docker-compose.yml @@ -17,7 +17,7 @@ x-internal-env: &internal-env POSTGRES_HOST: postgres POSTGRES_PORT: 5432 POSTGRES_DB: ${APP_NAME} - POSTGRES_USER: ${APP_NAME} + POSTGRES_USER: postgres CLICKHOUSE_HOST: http://clickhouse:8123 CLICKHOUSE_DB: ${APP_NAME} REDIS_HOST: redis diff --git a/apps/semaphore/docker-compose.yml b/apps/semaphore/docker-compose.yml index de0e682..be4038a 100644 --- a/apps/semaphore/docker-compose.yml +++ b/apps/semaphore/docker-compose.yml @@ -12,7 +12,7 @@ x-internal-env: &internal-env SEMAPHORE_DB_DIALECT: postgres SEMAPHORE_DB_HOST: postgres SEMAPHORE_DB_NAME: ${APP_NAME} - SEMAPHORE_DB_USER: ${APP_NAME} + SEMAPHORE_DB_USER: postgres SEMAPHORE_ADMIN: admin SEMAPHORE_ADMIN_NAME: admin SEMAPHORE_TELEGRAM_ALERT: true