-
-
Notifications
You must be signed in to change notification settings - Fork 1.9k
Description
What problem will this feature address?
While reviewing install.sh, I noticed that the database password being created is always the same for every installation. This could represent a potential security concern.
I understand that the database is not exposed externally and runs on the same server, but it would still be better from a security standpoint to generate a unique password for each installation.
Describe the solution you'd like
It would be advisable to remove the DATABASE_URL variable from the .env file, or at least ensure that the application prioritizes the system environment variable over the one defined in .env.
Additionally, the installation script could be improved by generating a unique database password during setup and passing it consistently to both PostgreSQL and Dokploy.
Describe alternatives you've considered
For now, I have manually changed the database password. After that, I created a Docker config and passed it to the Dokploy container, which overrides the .env file.
Additional context
No response
Will you send a PR to implement it?
Maybe, need help