fix: protect agent canary database credentials

2026-08-23 02:59:14 +03:00
parent bb18cb4f1c
commit 446e98ce1a
5 changed files with 87 additions and 4 deletions
@@ -99,8 +99,12 @@ services:
      POSTGRES_PORT: "5432"
      POSTGRES_DATABASE: ${POSTGRES_DB:-assistant}
      WORK_POSTGRES_USER: work_role
-      WORK_POSTGRES_PASSWORD: ${WORK_DB_PASSWORD}
+      WORK_POSTGRES_CREDENTIAL_REF: credential://domovoy/work/db-password/v1
+      WORK_POSTGRES_PASSWORD_FILE: /run/secrets/work_db_password
+      SECRET_BACKEND_ROOT: /run/secrets
    depends_on: { postgres: { condition: service_healthy } }
+    volumes:
+      - assistant_core_secrets:/run/secrets:ro

  agent-worker:
    build: { context: .., dockerfile: deploy/images/runtime.Dockerfile, args: { TARGET: agent-worker, SOURCE_REVISION: "${ASSISTANT_SOURCE_REVISION:-unknown}" } }