From 13f62522980e748d92e6309a32abb3d367ed73f5 Mon Sep 17 00:00:00 2001 From: Antonius Moritz <5209092+tarantila@users.noreply.github.com> Date: Sun, 7 Jun 2026 16:13:37 +0200 Subject: [PATCH] fix(docs): generate URL-safe Postgres passwords openssl rand -base64 24 can emit URI-reserved characters (/, +, =). Since POSTGRES_PASSWORD is interpolated unescaped into DATABASE_URL, such a password breaks the connection URL and blocks boot. Switch every documented example to openssl rand -hex 32 (URL-safe, 256-bit). --- .env.example | 2 +- .env.production.example | 2 +- CONTRIBUTING.md | 4 ++-- README.md | 2 +- docs/self-hosting/getting-started.md | 2 +- scripts/env-manifest.json | 2 +- 6 files changed, 7 insertions(+), 7 deletions(-) diff --git a/.env.example b/.env.example index fc060f7c2..78698a34f 100644 --- a/.env.example +++ b/.env.example @@ -25,7 +25,7 @@ DATABASE_URL="postgresql://healthlog:CHANGE-ME@db:5432/healthlog?schema=public" # Postgres password — used both by the db service AND by DATABASE_URL above. -# Pick a strong random password, e.g. `openssl rand -base64 24`. +# Pick a strong random password, e.g. `openssl rand -hex 32`. POSTGRES_PASSWORD="CHANGE-ME" diff --git a/.env.production.example b/.env.production.example index 383a9e0b9..0cfdc6a33 100644 --- a/.env.production.example +++ b/.env.production.example @@ -21,7 +21,7 @@ # Core -- required for boot # ----------------------------------------------------------------------------- DATABASE_URL="postgresql://healthlog:@db:5432/healthlog?schema=public" -POSTGRES_PASSWORD="" +POSTGRES_PASSWORD="" NEXT_PUBLIC_APP_URL="https://healthlog.example.com" APP_URL="https://healthlog.example.com" ENCRYPTION_KEY="" diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 20eaafeb2..c2edb825d 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -20,7 +20,7 @@ cp .env.example .env Edit `.env` and configure at minimum: ``` -POSTGRES_PASSWORD= +POSTGRES_PASSWORD= DATABASE_URL="postgresql://healthlog:${POSTGRES_PASSWORD}@db:5432/healthlog" ENCRYPTION_KEY=<64-char hex> API_TOKEN_HMAC_KEY=<64-char hex> @@ -29,7 +29,7 @@ API_TOKEN_HMAC_KEY=<64-char hex> Generate the three secrets: ```bash -echo "POSTGRES_PASSWORD=$(openssl rand -base64 24)" >> .env +echo "POSTGRES_PASSWORD=$(openssl rand -hex 32)" >> .env echo "ENCRYPTION_KEY=$(openssl rand -hex 32)" >> .env echo "API_TOKEN_HMAC_KEY=$(openssl rand -hex 32)" >> .env ``` diff --git a/README.md b/README.md index b52e88a11..4983f2736 100644 --- a/README.md +++ b/README.md @@ -176,7 +176,7 @@ cp .env.example .env Generate the three required secrets and paste them into `.env`: ```bash -echo "POSTGRES_PASSWORD=$(openssl rand -base64 24)" >> .env +echo "POSTGRES_PASSWORD=$(openssl rand -hex 32)" >> .env echo "ENCRYPTION_KEY=$(openssl rand -hex 32)" >> .env echo "API_TOKEN_HMAC_KEY=$(openssl rand -hex 32)" >> .env ``` diff --git a/docs/self-hosting/getting-started.md b/docs/self-hosting/getting-started.md index 96f1db1aa..e2bcdfb4c 100644 --- a/docs/self-hosting/getting-started.md +++ b/docs/self-hosting/getting-started.md @@ -38,7 +38,7 @@ HealthLog needs three secrets before it will boot. Generate them with `openssl` and append to `.env`: ```bash -echo "POSTGRES_PASSWORD=$(openssl rand -base64 24)" >> .env +echo "POSTGRES_PASSWORD=$(openssl rand -hex 32)" >> .env echo "ENCRYPTION_KEY=$(openssl rand -hex 32)" >> .env echo "API_TOKEN_HMAC_KEY=$(openssl rand -hex 32)" >> .env ``` diff --git a/scripts/env-manifest.json b/scripts/env-manifest.json index 0f2710c4e..08c4fbea2 100644 --- a/scripts/env-manifest.json +++ b/scripts/env-manifest.json @@ -15,7 +15,7 @@ { "name": "POSTGRES_PASSWORD", "purpose": "Database password for the bundled `db` service in docker-compose.yml.", - "example": "" + "example": "" }, { "name": "NEXT_PUBLIC_APP_URL",