fix(docs): generate URL-safe Postgres passwords

openssl rand -base64 24 can emit URI-reserved characters (/, +, =). Since POSTGRES_PASSWORD is interpolated unescaped into DATABASE_URL, such a password breaks the connection URL and blocks boot. Switch every documented example to openssl rand -hex 32 (URL-safe, 256-bit).

.env.example

@@ -25,7 +25,7 @@
 DATABASE_URL="postgresql://healthlog:CHANGE-ME@db:5432/healthlog?schema=public"
 
 # Postgres password — used both by the db service AND by DATABASE_URL above.
-# Pick a strong random password, e.g. `openssl rand -base64 24`.
+# Pick a strong random password, e.g. `openssl rand -hex 32`.
 POSTGRES_PASSWORD="CHANGE-ME"
 
 

.env.production.example

@@ -21,7 +21,7 @@
 # Core -- required for boot
 # -----------------------------------------------------------------------------
 DATABASE_URL="postgresql://healthlog:<password>@db:5432/healthlog?schema=public"
-POSTGRES_PASSWORD="<openssl rand -base64 24>"
+POSTGRES_PASSWORD="<openssl rand -hex 32>"
 NEXT_PUBLIC_APP_URL="https://healthlog.example.com"
 APP_URL="https://healthlog.example.com"
 ENCRYPTION_KEY="<openssl rand -hex 32>"

CONTRIBUTING.md

@@ -20,7 +20,7 @@ cp .env.example .env
 Edit `.env` and configure at minimum:
 
 ```
-POSTGRES_PASSWORD=<base64, 24 bytes>
+POSTGRES_PASSWORD=<hex, 32 bytes>
 DATABASE_URL="postgresql://healthlog:${POSTGRES_PASSWORD}@db:5432/healthlog"
 ENCRYPTION_KEY=<64-char hex>
 API_TOKEN_HMAC_KEY=<64-char hex>
@@ -29,7 +29,7 @@ API_TOKEN_HMAC_KEY=<64-char hex>
 Generate the three secrets:
 
 ```bash
-echo "POSTGRES_PASSWORD=$(openssl rand -base64 24)" >> .env
+echo "POSTGRES_PASSWORD=$(openssl rand -hex 32)" >> .env
 echo "ENCRYPTION_KEY=$(openssl rand -hex 32)"       >> .env
 echo "API_TOKEN_HMAC_KEY=$(openssl rand -hex 32)"   >> .env
 ```

README.md

@@ -176,7 +176,7 @@ cp .env.example .env
 Generate the three required secrets and paste them into `.env`:
 
 ```bash
-echo "POSTGRES_PASSWORD=$(openssl rand -base64 24)" >> .env
+echo "POSTGRES_PASSWORD=$(openssl rand -hex 32)" >> .env
 echo "ENCRYPTION_KEY=$(openssl rand -hex 32)"       >> .env
 echo "API_TOKEN_HMAC_KEY=$(openssl rand -hex 32)"   >> .env
 ```

docs/self-hosting/getting-started.md

@@ -38,7 +38,7 @@ HealthLog needs three secrets before it will boot. Generate them with
 `openssl` and append to `.env`:
 
 ```bash
-echo "POSTGRES_PASSWORD=$(openssl rand -base64 24)" >> .env
+echo "POSTGRES_PASSWORD=$(openssl rand -hex 32)" >> .env
 echo "ENCRYPTION_KEY=$(openssl rand -hex 32)"       >> .env
 echo "API_TOKEN_HMAC_KEY=$(openssl rand -hex 32)"   >> .env
 ```

scripts/env-manifest.json

@@ -15,7 +15,7 @@
         {
           "name": "POSTGRES_PASSWORD",
           "purpose": "Database password for the bundled `db` service in docker-compose.yml.",
-          "example": "<openssl rand -base64 24>"
+          "example": "<openssl rand -hex 32>"
         },
         {
           "name": "NEXT_PUBLIC_APP_URL",