fix: db password comes from 1Password, no compose default (!51) · Merge requests · Tools / CMOAgent

isidro requested to merge fix/db-password-required into main Sep 26, 2026

Rotates the Postgres password that shipped as the compose default (exposed on the LAN and tailnet until !50 (merged)).

.env.tpl: POSTGRES_PASSWORD from op://ThioBot/CMOAgent Postgres URL/db_password.
docker-compose.yml: ${POSTGRES_PASSWORD:?…} instead of a default, in the db service and the five DATABASE_URLs.

Test plan

docker compose config passes with the variable set and fails with a clear message without it
After merge: update the 1Password item, ALTER USER, op inject, docker compose up -d, restart the native portal, check every service healthy

🤖 Generated with Claude Code

fix: db password comes from 1Password, no compose default