From a11d6504167d3a144127cac514c0936fc23a9a80 Mon Sep 17 00:00:00 2001 From: Thomas Joise Date: Sat, 18 Jul 2026 01:02:58 +0530 Subject: [PATCH] docs(deploy): HQ connects as shared postgres superuser (no per-app roles on box) Co-Authored-By: Claude Opus 4.8 (1M context) --- deploy/PATHS-AND-NAMES.md | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/deploy/PATHS-AND-NAMES.md b/deploy/PATHS-AND-NAMES.md index f3e97e2..b49b76d 100644 --- a/deploy/PATHS-AND-NAMES.md +++ b/deploy/PATHS-AND-NAMES.md @@ -52,11 +52,10 @@ other apps. (D20 target, revised: `.in` not `.com`, Docker not RDS — see notes | Thing | Value | |---|---| -| Superuser (admin) | `postgres` (connect via `sudo docker exec -i accurate-postgres psql -U postgres`) | -| HQ database | `hq` | -| HQ role (login) | `hq` | -| HQ password | *generated on the box*, stored only in `apps/hq/.env` — never in git | -| Connection string | `postgres://hq:@host.docker.internal:5432/hq` | +| Superuser (admin) | `postgres` (connect via `sudo docker exec -it accurate-postgres psql -U postgres`) | +| HQ database | `hq` (owned by `postgres`) | +| HQ login | `postgres` — the shared superuser. Every app on this box uses it; there are **no** per-app roles (checked 2026-07-18). A dedicated `hq` role is a future hardening. | +| Connection string | `postgres://postgres:@host.docker.internal:5432/hq` | ## App environment (`apps/hq/.env`) @@ -64,7 +63,7 @@ other apps. (D20 target, revised: `.in` not `.com`, Docker not RDS — see notes |---|---| | `HQ_PORT` | `5182` | | `HQ_OWNER_EMAIL` | `simssoftware13@gmail.com` (first-boot owner login) | -| `DATABASE_URL` | `postgres://hq:@host.docker.internal:5432/hq` | +| `DATABASE_URL` | `postgres://postgres:@host.docker.internal:5432/hq` | | `SIMS_PIN_PEPPER` | generated on box — **set once, never change** | | `HQ_SECRET_KEY` | generated on box (needed before Gmail) |