Jens/geointel
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Remove PostGIS password from image metadata
GeoIntel CI / docs-smoke (push) Has been cancelled
Details
GeoIntel CI / contract-smoke (push) Has been cancelled
Details

Browse Source
This commit is contained in:
Codex
2026-06-17 06:08:38 +02:00
parent 96e994894b
commit b2e23222fa
6 changed files with 47 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/CODEX_EXECUTION_LOG.md
+29
View File
@@ -1594,3 +1594,32 @@ Limitations:
Next recommended pass:
- Run the full release-readiness gate and then rebuild/deploy to Tower for browser-facing verification.
## Sprint 35 Docker runtime secret hygiene (2026-06-17)
Changed:
- Removed embedded PostGIS database name/user/password defaults from `deploy/unraid/Dockerfile.all-in-one` image metadata.
- Kept database credentials as runtime configuration supplied by `.env`, the Unraid template, Compose or `docker run -e`.
- Added regression coverage so `GEOINTEL_POSTGRES_PASSWORD` is not baked into the all-in-one Dockerfile again.
- Updated Unraid runtime documentation and changelog.
Tested:
- `cd backend && python -m pytest tests/test_sprint31_unraid_template.py tests/test_docker_runtime_config.py -q`
- `bash -n deploy/unraid/all-in-one-start.sh`
- `bash -n deploy/unraid/run-dockerman-container.sh`
- `python -m compileall backend/app`
- `cd backend && python -m pytest -W error::DeprecationWarning`
- `cd frontend && npm run typecheck`
- `cd frontend && npm run build`
- `bash scripts/run_readiness_check.sh`
- `cd backend && python -m alembic heads && python -m alembic upgrade head --sql`
Open:
- Local Windows shell has no `docker` command in PATH, so Docker build/config verification must run on Tower during deploy.
- Rebuild the Tower image and confirm the Docker BuildKit `SecretsUsedInArgOrEnv` warning is gone.
Limitations:
- The start script still has safe local defaults for standalone/dev startup. Shared deployments should set `GEOINTEL_POSTGRES_PASSWORD` via runtime configuration.
Next recommended pass:
- Run release readiness, rebuild/deploy Tower and verify browser/GIS/demo smoke again.
docs/TODO.md
+1
View File
@@ -12,6 +12,7 @@ This file now starts with the current implementation status. Older preparation/b
- [x] Run Docker/PostGIS live validation on Tower/Unraid.
- [x] Add Unraid Compose template assets with editable ports, storage path and app icon.
- [x] Add single-container Unraid runtime with embedded PostGIS, backend and frontend.
- [x] Remove embedded PostGIS password defaults from all-in-one Docker image metadata.
## Current implementation status