fix: replace hardcoded credentials in docker-compose and harden server/.gitignore (#1527)

[carlosjarenom]

Summary

Fix remaining security issues from #1527 (part 2 was already addressed in a prior commit).

Changes

1. Replace hardcoded database passwords in compose files

• server/docker-compose.yml: Replace all instances of 123456 with ${POSTGRES_PASSWORD:-123456}
  • POSTGRES_PASSWORD environment variable for the Postgres service
  • database_url references in api, celery_worker, and celery_beat services (both build args and runtime env)
• server/docker-compose.dev.yml: Same replacement for the Postgres service

2. Harden server/.gitignore

• Add .\env to prevent accidental credential commits from the server directory
• Add alembic.ini which may contain database connection strings

3. Update server/.env.example

• Add POSTGRES_PASSWORD=CHANGE_ME placeholder
• Change secret_key=postgres to secret_key=CHANGE_ME

Backwards Compatibility

All substitutions use ${POSTGRES_PASSWORD:-123456} syntax, so existing deployments that don't set POSTGRES_PASSWORD will continue to work with the default value. New deployments can override by setting the variable in their .\env file.

Related

• Closes Security: hardcoded credentials in docker-compose and chat_share.py #1527 (partial — part 2 on chat_share.py was already fixed)

[carlosjarenom]

Rebased on latest upstream/main and force-pushed.

Changes: Replaced hardcoded 123456 passwords in docker-compose.yml and docker-compose.dev.yml with ${POSTGRES_PASSWORD:***} env var syntax. Added .env and alembic.ini to server/.gitignore. Updated .env.example with POSTGRES_PASSWORD=*** and secret_key=CHANGE_ME.

[4pmtong]

Hi @carlosjarenom Thanks for the security cleanup here. One small thing to double-check: database_url is now passed through build.args, and server/Dockerfile currently turns ARG database_url into ENV database_url=$database_url. If someone sets a real POSTGRES_PASSWORD, that credential may end up baked into the Docker image metadata after build.

Could we keep database_url runtime-only in compose and avoid passing the deployment password as a build arg? If the build still needs a value, a non-secret placeholder would be safer.