Sicherheit: DB-Passwort rotieren und aus Secret laden

2026-07-12 21:43:02 +02:00
parent 762812649c
commit 4f5042dc43
2 changed files with 9 additions and 2 deletions
@@ -22,8 +22,15 @@ jobs:

      - name: Deploy
        env:
+          MINDFLUX_DB_PASSWORD: ${{ secrets.MINDFLUX_DB_PASSWORD }}
          MINDFLUX_ADMIN_PASSWORD: ${{ secrets.MINDFLUX_ADMIN_PASSWORD }}
          MINDFLUX_ADMIN2_PASSWORD: ${{ secrets.MINDFLUX_ADMIN2_PASSWORD }}
        run: |
+          test -n "$MINDFLUX_DB_PASSWORD" || { echo "MINDFLUX_DB_PASSWORD fehlt" >&2; exit 1; }
+          docker exec -i -e NEW_DB_PASSWORD="$MINDFLUX_DB_PASSWORD" postgres \
+            psql -v ON_ERROR_STOP=1 -U mindflux -d mindfluxdb <<'SQL'
+          \getenv new_db_password NEW_DB_PASSWORD
+          ALTER USER mindflux WITH PASSWORD :'new_db_password';
+          SQL
          docker compose -f docker-compose.yml pull
          docker compose -f docker-compose.yml up -d