fix(scripts): require DB_PASSWORD env var in setup-database.sh #13

2026-04-18T20:02:18Z

nsatoshi commented

2026-04-18 20:02:18 +00:00

Summary

PR #3 scrubbed L@ker$2010 from every env file, compose unit, and deployment doc but missed scripts/setup-database.sh, which still hardcoded DB_PASSWORD="L@ker\$2010" on line 17. That slipped past gitleaks because the shell-escaped form (\$) doesn't literally match the L@kers?\$?2010 regex committed in .gitleaks.toml — the regex was written to catch the expanded form, not the source form.

This PR removes the hardcoded default and requires DB_PASSWORD to be exported by the operator before running the script. Same fail-fast pattern as the rest of the PR #3 conversion.

Changes

scripts/setup-database.sh:

-DB_USER="explorer"
-DB_PASSWORD="L@ker\$2010"
-DB_NAME="explorer"
+DB_USER="${DB_USER:-explorer}"
+DB_NAME="${DB_NAME:-explorer}"
+if [ -z "${DB_PASSWORD:-}" ]; then
+    echo "ERROR: DB_PASSWORD environment variable must be set before running this script." >&2
+    echo "Generate a strong value (e.g. openssl rand -base64 32) and export it:" >&2
+    echo "  export DB_PASSWORD='<strong random password>'" >&2
+    echo "  sudo -E bash scripts/setup-database.sh" >&2
+    exit 1
fi

Verification

git grep -nE 'L@kers?\\?\$?2010' -- scripts/ → no matches.
bash -n scripts/setup-database.sh → clean.

Follow-up

After this merges, a history rewrite (git filter-repo --replace-text) will purge the string from all prior commits, then force-push rewritten refs. Separate from this PR.

Note on the gitleaks rule

The regex in .gitleaks.toml will be tightened in the history-rewrite PR to also catch the escaped form (L@kers?\\?\$?2010) so this class of oversight can't recur.

## Summary [PR #3](https://gitea.d-bis.org/d-bis/explorer-monorepo/pulls/3) scrubbed `L@ker$2010` from every env file, compose unit, and deployment doc but **missed `scripts/setup-database.sh`**, which still hardcoded `DB_PASSWORD="L@ker\$2010"` on line 17. That slipped past gitleaks because the shell-escaped form (`\$`) doesn't literally match the `L@kers?\$?2010` regex committed in `.gitleaks.toml` — the regex was written to catch the *expanded* form, not the source form. This PR removes the hardcoded default and requires `DB_PASSWORD` to be exported by the operator before running the script. Same fail-fast pattern as the rest of the PR #3 conversion. ## Changes `scripts/setup-database.sh`: ```diff -DB_USER="explorer" -DB_PASSWORD="L@ker\$2010" -DB_NAME="explorer" +DB_USER="${DB_USER:-explorer}" +DB_NAME="${DB_NAME:-explorer}" +if [ -z "${DB_PASSWORD:-}" ]; then + echo "ERROR: DB_PASSWORD environment variable must be set before running this script." >&2 + echo "Generate a strong value (e.g. openssl rand -base64 32) and export it:" >&2 + echo " export DB_PASSWORD='<strong random password>'" >&2 + echo " sudo -E bash scripts/setup-database.sh" >&2 + exit 1 fi ``` ## Verification - `git grep -nE 'L@kers?\\?\$?2010' -- scripts/` → no matches. - `bash -n scripts/setup-database.sh` → clean. ## Follow-up After this merges, a history rewrite (`git filter-repo --replace-text`) will purge the string from all prior commits, then force-push rewritten refs. Separate from this PR. ## Note on the gitleaks rule The regex in `.gitleaks.toml` will be tightened in the history-rewrite PR to also catch the escaped form (`L@kers?\\?\$?2010`) so this class of oversight can't recur.

nsatoshi merged commit baf05294c6 into master

2026-04-18 20:02:49 +00:00

nsatoshi referenced this issue from a commit

2026-04-18 20:02:50 +00:00

Merge pull request 'fix(scripts): require DB_PASSWORD env var in setup-database.sh' (#13) from devin/1776542488-fix-setup-database-hardcoded-password into master

nsatoshi referenced this issue from a commit

2026-04-18 20:06:45 +00:00

Merge pull request 'fix(scripts): require DB_PASSWORD env var in setup-database.sh' (#13) from devin/1776542488-fix-setup-database-hardcoded-password into master

nsatoshi referenced this issue from a commit

2026-04-18 20:08:17 +00:00

security: tighten gitleaks regex for escaped form, document history-purge audit trail

nsatoshi referenced this pull request