chore(deploy): read pg creds from env, drop hardcoded placeholder

[satyakwok]

Why

Both docker-compose.yml (mainnet) and docker-compose.testnet.yml shipped with hardcoded placeholder POSTGRES_PASSWORD: indexer and full INDEXER_DATABASE_URL: postgres://indexer:indexer@postgres:5432/.... Even though postgres binds 127.0.0.1 only, having the literal placeholder in a public repo makes any vps4-side foothold (RCE in another service, SSH key compromise) a trivial DB pivot — and primes anyone who copies this compose for production to ship the same weak default.

What

• Replace literals with required-env interpolation: ${POSTGRES_PASSWORD:?env required} etc. (?env required syntax fails compose-up if env not set, so silent fallback to placeholder is impossible)
• Add .env.production to .gitignore
• Operator runs locally with --env-file .env.production (gitignored, holds the strong random password)
• .env.example retains placeholder values for dev/CI templates

Verify

docker compose -p sentrix-testnet -f docker-compose.testnet.yml --env-file .env.production up -d

Verified all 3 testnet containers come up healthy + indexer auth-success against pg with the new strong creds. testnet-api.sentrixchain.com keeps serving.

Operator action

Generate strong password (openssl rand -base64 32 | tr -d '/=+' | head -c 32), put in .env.production per .env.example template, run the compose-up command above. Existing pg user can be rotated via ALTER USER indexer WITH PASSWORD '<new>'; before restart so live connections aren't disrupted.

Summary by CodeRabbit

• Chores
  • Docker Compose configurations now require explicit environment variables for database credentials and connection URLs at runtime instead of relying on default values.
  • Production environment configuration files are now properly excluded from version control.

[coderabbitai]

Caution

Review failed

Pull request was closed or merged during review

📝 Walkthrough

Walkthrough

This PR externalizes hardcoded database credentials and connection strings to required environment variables in docker-compose configurations, and excludes production environment files from version control.

Changes

Configuration Externalization

Layer / File(s)	Summary
Production environment file exclusion .gitignore	.env.production is added to .gitignore to prevent production environment configuration from being committed.
Docker Compose database configuration externalization docker-compose.testnet.yml, docker-compose.yml	Postgres service environment variables POSTGRES_USER, POSTGRES_PASSWORD, and POSTGRES_DB are switched from hardcoded values to required environment variables. Indexer and api services' INDEXER_DATABASE_URL are updated from fixed connection strings to required environment variables in both testnet and production docker-compose files.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Poem

🐰 From hardcoded secrets we now break free,
Environment variables set the config spree,
.env.production hides with care,
Docker compose defaults? No longer there!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main security-focused change: moving from hardcoded database credentials in compose files to environment-based configuration.
Description check	✅ Passed	The description provides comprehensive context including rationale, implementation details, and verification steps, though it deviates from the template structure.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/db-creds-from-env

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}