fix(self-hosting): stop publishing Postgres and require POSTGRES_PASSWORD by waleedlatif1 · Pull Request #8035 · simstudioai/sim

waleedlatif1 · 2026-09-19T21:09:46Z

Summary

docker-compose.prod.yml, docker-compose.local.yml and docker-compose.ollama.yml no longer publish the db service to the host. Every service already reaches it as db:5432 over the Compose network. A ports: mapping bound every interface, and Docker's iptables rules bypass host firewalls
docker-compose.prod.yml now requires POSTGRES_PASSWORD (${VAR:?}) in the db service and all three DATABASE_URLs instead of falling back to postgres, matching the auth secrets next to it. The local and Ollama dev stacks keep their defaults, since every secret there is a dev default and the port is what made it reachable
The error message covers upgrades too. Postgres only applies POSTGRES_PASSWORD when it creates the volume, so an install that never set it must use postgres; a freshly generated value would lock the app out of its own database
sim-setup writes the value before bringing the stack up (setup, start, restart, update), but only when the compose file on disk requires it. It generates a password for a new install; for an existing postgres_data volume (found by Compose labels, project name read from docker compose config --no-interpolate) it keeps postgres and prints how to rotate it. A value set in the shell environment wins, matching Compose
The simstudio CLI stops publishing 5432. Its containers already use their own Docker network, and it recreates them on every run
Docs: security, Docker and upgrade guides updated to match. The README's Cursor setup prompt now generates POSTGRES_PASSWORD

Type of Change

Bug fix

Testing

New compose-database.test.ts: password choice (new vs. existing volume vs. already set), shell-env precedence, and checks on the real compose files: no db port in any of them, and every prod POSTGRES_PASSWORD reference required. All five compose-file checks fail against the previous files
End to end with docker compose and pgvector/pgvector:pg17, three scenarios, all passing:
- Install created from the previous file with no password, then switched to the new file: Compose stops with the message, sim-setup writes postgres, and the app's DATABASE_URL authenticates
- Fresh install: sim-setup generates a 64-hex password and the app's DATABASE_URL authenticates
- Project name derived from the directory instead of COMPOSE_PROJECT_NAME: sim-setup finds the existing volume, keeps postgres, and the app's DATABASE_URL authenticates
- In every case docker port shows no host bindings, and a second run changes nothing
Local and Ollama files still render with zero config
sim-setup 168/168, type-check (sim-setup, cli), lint, check:audits (47), docs-manifest:check

Checklist

Code follows project style guidelines
Self-reviewed my changes
Tests added/updated and passing
No new warnings introduced
I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

🤖 Generated with Claude Code

…WORD The Compose files published the db service on every host interface, and the production file fell back to the password postgres when POSTGRES_PASSWORD was unset. The db is now reachable only over the Compose network, and the production file refuses to start without POSTGRES_PASSWORD. sim-setup writes the value an install needs before bringing it up: a generated password for a new database, and the legacy one for a volume created before it was required, since Postgres ignores POSTGRES_PASSWORD on an existing data directory.

vercel · 2026-09-19T21:09:52Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs	Ready	Preview	Sep 19, 2026 10:54pm UTC

greptile-apps · 2026-09-19T21:14:53Z

Confidence Score: 5/5

The PR appears safe to merge, with no outstanding actionable findings from the latest changes.

Summary

This PR hardens self-hosted PostgreSQL deployments by removing host port publication, requiring an explicit production database password, and teaching setup workflows to preserve compatibility with existing volumes.

Removes PostgreSQL host bindings from production, local, Ollama, and standalone CLI deployments.
Generates a password for new production installs while retaining the legacy password for detected existing volumes.
Updates lifecycle commands, tests, and operator documentation for installation, upgrades, rotation, and URL-safe credentials.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Start or update Compose install] --> B{Production Compose requires password?}
    B -- No --> C[Continue unchanged]
    B -- Yes --> D{Shell exports POSTGRES_PASSWORD?}
    D -- Yes --> E[Let Compose use shell value]
    D -- No --> F{Password exists in .env?}
    F -- Yes --> G[Keep recorded value]
    F -- No --> H{Existing labeled database volume?}
    H -- Yes --> I[Write legacy password postgres]
    H -- No --> J[Generate and write random password]
    E --> K[Run Compose]
    G --> K
    I --> K
    J --> K

_{Reviews (6) · Last reviewed commit: "docs(self-hosting): note that POSTGRES_*..."}

…ctive role A password exported only in the shell is now written to .env, so a later run without the export does not fall back to the legacy value. Rotation steps use the install's POSTGRES_USER and ALTER ROLE CURRENT_USER.

waleedlatif1 · 2026-09-19T21:20:16Z

@greptile

waleedlatif1 · 2026-09-19T21:20:17Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-09-19T21:20:23Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

All reported issues were addressed across 12 files

_{Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic}

…WORD An empty export, one that differs from .env, or one .env cannot hold verbatim now stops setup with instructions instead of silently picking a value the database may not have been created with.

waleedlatif1 · 2026-09-19T21:31:59Z

@greptile

waleedlatif1 · 2026-09-19T21:32:00Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-09-19T21:32:05Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

All reported issues were addressed across 12 files

_{Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic}

… POSTGRES_USER export DATABASE_URL embeds the password unescaped, so a shell-only password is persisted only when it is made of URL-unreserved characters. An empty POSTGRES_USER export resolves to the Compose default, matching ${POSTGRES_USER:-postgres}.

waleedlatif1 · 2026-09-19T21:42:42Z

@greptile

waleedlatif1 · 2026-09-19T21:42:43Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-09-19T21:42:48Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

All reported issues were addressed across 12 files

_{Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic}

Compose interpolates a shell value over .env, so the wizard no longer copies it into .env and no longer needs rules for values .env or DATABASE_URL would change. An empty export is still refused, since Compose would use it and refuse to start.

waleedlatif1 · 2026-09-19T22:46:22Z

@greptile

waleedlatif1 · 2026-09-19T22:46:23Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-09-19T22:46:28Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

No issues found across 12 files

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

_{Re-trigger cubic}

docker-compose.prod.yml composes DATABASE_URL from them as written, so a value containing a URL delimiter initializes the database but breaks the connection string.

waleedlatif1 · 2026-09-19T22:52:56Z

@greptile

waleedlatif1 · 2026-09-19T22:52:57Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-09-19T22:53:03Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

No issues found across 12 files

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

_{Re-trigger cubic}

vercel Bot deployed to Preview September 19, 2026 21:11 View deployment

greptile-apps Bot reviewed Sep 19, 2026

View reviewed changes

Comment thread packages/sim-setup/src/compose-database.ts Outdated

Comment thread packages/sim-setup/src/compose-database.ts Outdated

Comment thread packages/sim-setup/src/compose-database.ts Outdated

vercel Bot deployed to Preview September 19, 2026 21:21 View deployment

greptile-apps Bot reviewed Sep 19, 2026

View reviewed changes

Comment thread packages/sim-setup/src/compose-database.ts Outdated

cubic-dev-ai Bot reviewed Sep 19, 2026

View reviewed changes

Comment thread packages/sim-setup/src/compose-database.ts Outdated

Comment thread packages/sim-setup/src/lifecycle.ts

Comment thread packages/sim-setup/src/compose-database.ts Outdated

fix(sim-setup): refuse an ambiguous or unstorable shell POSTGRES_PASS…

d4ee337

…WORD An empty export, one that differs from .env, or one .env cannot hold verbatim now stops setup with instructions instead of silently picking a value the database may not have been created with.

vercel Bot temporarily deployed to Preview September 19, 2026 21:31 Inactive

cubic-dev-ai Bot reviewed Sep 19, 2026

View reviewed changes

Comment thread packages/sim-setup/src/compose-database.ts Outdated

Comment thread packages/sim-setup/src/compose-database.ts

Comment thread packages/sim-setup/src/compose-database.ts Outdated

vercel Bot temporarily deployed to Preview September 19, 2026 21:42 Inactive

cubic-dev-ai Bot reviewed Sep 19, 2026

View reviewed changes

Comment thread packages/sim-setup/src/compose-database.ts Outdated

greptile-apps Bot reviewed Sep 19, 2026

View reviewed changes

Comment thread packages/sim-setup/src/compose-database.ts Outdated

vercel Bot temporarily deployed to Preview September 19, 2026 22:46 Inactive

greptile-apps Bot reviewed Sep 19, 2026

View reviewed changes

Comment thread packages/sim-setup/src/compose-database.ts

cubic-dev-ai Bot reviewed Sep 19, 2026

View reviewed changes

docs(self-hosting): note that POSTGRES_* values must be URL-safe

6b45b97

docker-compose.prod.yml composes DATABASE_URL from them as written, so a value containing a URL delimiter initializes the database but breaks the connection string.

cubic-dev-ai Bot reviewed Sep 19, 2026

View reviewed changes

vercel Bot deployed to Preview September 19, 2026 22:54 View deployment

waleedlatif1 merged commit 6b46f69 into staging Sep 19, 2026
34 checks passed

waleedlatif1 deleted the fix/compose-postgres-defaults branch September 19, 2026 22:59

This was referenced Sep 19, 2026

v0.8.48: search improvements, file versions #8008

Closed

v0.8.48: prewarm, tin pg extensions, knowledge search speedups, ui consolidation, keyword search speedups #8096

Merged

Conversation

waleedlatif1 commented Sep 19, 2026

Summary

Type of Change

Testing

Checklist

Uh oh!

vercel Bot commented Sep 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

greptile-apps Bot commented Sep 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Confidence Score: 5/5

Summary

Uh oh!

Uh oh!

Uh oh!

Uh oh!

waleedlatif1 commented Sep 19, 2026

Uh oh!

waleedlatif1 commented Sep 19, 2026

Uh oh!

cubic-dev-ai Bot commented Sep 19, 2026

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

waleedlatif1 commented Sep 19, 2026

Uh oh!

waleedlatif1 commented Sep 19, 2026

Uh oh!

cubic-dev-ai Bot commented Sep 19, 2026

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

waleedlatif1 commented Sep 19, 2026

Uh oh!

waleedlatif1 commented Sep 19, 2026

Uh oh!

cubic-dev-ai Bot commented Sep 19, 2026

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

waleedlatif1 commented Sep 19, 2026

Uh oh!

waleedlatif1 commented Sep 19, 2026

Uh oh!

cubic-dev-ai Bot commented Sep 19, 2026

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

waleedlatif1 commented Sep 19, 2026

Uh oh!

waleedlatif1 commented Sep 19, 2026

Uh oh!

cubic-dev-ai Bot commented Sep 19, 2026

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

This branch was successfully deployed

Reviewers

Assignees

vercel Bot commented Sep 19, 2026 •

edited

Loading

greptile-apps Bot commented Sep 19, 2026 •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading