fix(examples/v3-reference-seller): drop literal POSTGRES_PASSWORD from compose (GitGuardian flag)

Author: bokelley

examples/v3_reference_seller/README.md

@@ -26,11 +26,11 @@ cd examples/v3_reference_seller
 docker compose up -d postgres
 
 # 2. Seed dev fixtures
-DATABASE_URL=postgresql+asyncpg://postgres:postgres@localhost/adcp \
+DATABASE_URL=postgresql+asyncpg://postgres@localhost/adcp \
   python -m seed
 
 # 3. Boot the seller
-DATABASE_URL=postgresql+asyncpg://postgres:postgres@localhost/adcp \
+DATABASE_URL=postgresql+asyncpg://postgres@localhost/adcp \
   python -m src.app
 ```
 

examples/v3_reference_seller/docker-compose.yml

@@ -6,10 +6,13 @@ services:
   postgres:
     image: postgres:16
     environment:
-      POSTGRES_PASSWORD: postgres
       POSTGRES_DB: adcp
       # ``trust`` is fine for the loopback dev compose; production
-      # deployments use scram-sha-256 + a real password.
+      # deployments use scram-sha-256 + a real password sourced from
+      # a secrets backend (Vault, AWS Secrets Manager, sealed-secrets).
+      # No POSTGRES_PASSWORD here on purpose — the ``trust`` auth
+      # method makes it unused, and shipping a literal in version
+      # control flags secret-scanners.
       POSTGRES_HOST_AUTH_METHOD: trust
     ports:
       - "5432:5432"

examples/v3_reference_seller/seed.py

@@ -4,7 +4,7 @@
 ::
 
     docker compose up -d postgres
-    DATABASE_URL=postgresql+asyncpg://postgres:postgres@localhost/adcp \\
+    DATABASE_URL=postgresql+asyncpg://postgres@localhost/adcp \\
       python -m examples.v3_reference_seller.seed
 
 After seeding, hit:
@@ -29,7 +29,7 @@
 async def main() -> None:
     db_url = os.environ.get(
         "DATABASE_URL",
-        "postgresql+asyncpg://postgres:postgres@localhost/adcp",
+        "postgresql+asyncpg://postgres@localhost/adcp",
     )
     engine = create_async_engine(db_url)
     async with engine.begin() as conn:

examples/v3_reference_seller/src/app.py

@@ -23,7 +23,7 @@
 
     cd examples/v3_reference_seller
     docker compose up -d postgres
-    DATABASE_URL=postgresql+asyncpg://postgres:postgres@localhost/adcp \\
+    DATABASE_URL=postgresql+asyncpg://postgres@localhost/adcp \\
       python -m src.app
 """
 
@@ -94,7 +94,7 @@ def main() -> None:
 
     db_url = os.environ.get(
         "DATABASE_URL",
-        "postgresql+asyncpg://postgres:postgres@localhost/adcp",
+        "postgresql+asyncpg://postgres@localhost/adcp",
     )
     port = int(os.environ.get("PORT", "3001"))