From 3b25fcbabee6c7b3077623e8d8b3599a6dfcba18 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Baki=20Burak=20=C3=96=C4=9F=C3=BCn?=
 <63836730+bakiburakogun@users.noreply.github.com>
Date: Sun, 30 Aug 2026 04:50:15 +0300
Subject: [PATCH 1/2] fix: do not log the database password on startup
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The startup script prints EXTERNAL_DB verbatim, so a deployment using an
external vector database writes its password into the container log on every
start, where docker logs and any log shipper will pick it up.

Redact the credentials before printing. The scheme, user, host and database
name stay visible, which is what the line is useful for.

Signed-off-by: Baki Burak Öğün <63836730+bakiburakogun@users.noreply.github.com>
---
 dockerfile_scripts/pgsql/setup.sh | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/dockerfile_scripts/pgsql/setup.sh b/dockerfile_scripts/pgsql/setup.sh
index 7578ed83..48ac1e00 100755
--- a/dockerfile_scripts/pgsql/setup.sh
+++ b/dockerfile_scripts/pgsql/setup.sh
@@ -22,7 +22,9 @@ if [ -n "${EXTERNAL_DB}" ]; then
         exit 1
     fi
 
-    echo "Using EXTERNAL_DB, CCB_DB_URL is set to: $EXTERNAL_DB"
+    # the password must not reach the container log
+    redacted_db_url=$(printf '%s' "$EXTERNAL_DB" | sed -E 's#(://[^:/@]*):[^@]*@#\1:***@#')
+    echo "Using EXTERNAL_DB, CCB_DB_URL is set to: $redacted_db_url"
 
     if ! grep -q "^export EXTERNAL_DB=" /etc/environment; then
         echo "export EXTERNAL_DB=\"$EXTERNAL_DB\"" >> /etc/environment

From 72a965ac1500392359a6ff563984333c7dacf332 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Baki=20Burak=20=C3=96=C4=9F=C3=BCn?=
 <63836730+bakiburakogun@users.noreply.github.com>
Date: Tue, 1 Sep 2026 12:24:14 +0300
Subject: [PATCH 2/2] fix: redact passwords that contain an at sign
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The character class stopped at the first '@', so a password containing one
left the rest of it in the log. Matching up to the last '@' of the authority
fixes that, and staying inside [^/] keeps an '@' in a later path segment from
swallowing the host.

Signed-off-by: Baki Burak Öğün <63836730+bakiburakogun@users.noreply.github.com>
---
 dockerfile_scripts/pgsql/setup.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dockerfile_scripts/pgsql/setup.sh b/dockerfile_scripts/pgsql/setup.sh
index 48ac1e00..691a7266 100755
--- a/dockerfile_scripts/pgsql/setup.sh
+++ b/dockerfile_scripts/pgsql/setup.sh
@@ -23,7 +23,7 @@ if [ -n "${EXTERNAL_DB}" ]; then
     fi
 
     # the password must not reach the container log
-    redacted_db_url=$(printf '%s' "$EXTERNAL_DB" | sed -E 's#(://[^:/@]*):[^@]*@#\1:***@#')
+    redacted_db_url=$(printf '%s' "$EXTERNAL_DB" | sed -E 's#(://[^:/@]*):[^/]*@#\1:***@#')
     echo "Using EXTERNAL_DB, CCB_DB_URL is set to: $redacted_db_url"
 
     if ! grep -q "^export EXTERNAL_DB=" /etc/environment; then