Add safe Postgres credential rotation

2026-07-18 00:29:13 +02:00
parent 38a3bd0869
commit fc42ea9af5
4 changed files with 176 additions and 0 deletions
@@ -1976,3 +1976,17 @@ bash scripts/restore_release_backup_smoke.sh \

 The restore smoke rejects the production database name, compares PostGIS,
 Alembic and retained table counts, and removes its temporary database.
+
+After a verified backup/restore, rotate a default production password without
+printing or committing the generated secret:
+
+```bash
+bash scripts/rotate_postgres_password.sh \
+  --container geointel \
+  --env-file /mnt/user/appdata/geointel/.env \
+  --restart-all-in-one
+```
+
+The command atomically updates the operator-owned `.env`, changes the matching
+PostgreSQL role and recreates the container. A failed role change restores the
+previous environment file. The generated secret is never printed.