cc: fix DB wiring — base compose hardcodes unicorn_user/magical_password and builds DATABASE_URL from raw creds (Prisma URL-parse crash with base64 pw)

- docker-compose.cc.yml: database env + calcom DATABASE_URL/DIRECT_URL from .env
- cc.env.example: require HEX (URL-safe) secrets; hex generation commands

cc.env.example

@@ -2,11 +2,13 @@
 # Template spec for the production `.env`; ansible renders `.env` from the
 # cc-ansible vault (group_vars/cc_apps/vault.yml) — keep the two in sync.
 # Never commit the real `.env`. Generate secrets with:
-#   NEXTAUTH_SECRET=$(openssl rand -base64 32)
-#   CALENDSO_ENCRYPTION_KEY=$(openssl rand -base64 24)
-#   CALCOM_APP_CREDENTIAL_ENCRYPTION_KEY=$(openssl rand -base64 32)
-#   JWT_SECRET=$(openssl rand -base64 32)
-#   POSTGRES_PASSWORD=$(openssl rand -base64 24)
+#   NEXTAUTH_SECRET=$(openssl rand -hex 32)
+#   CALENDSO_ENCRYPTION_KEY=$(openssl rand -hex 24)
+#   CALCOM_APP_CREDENTIAL_ENCRYPTION_KEY=$(openssl rand -hex 32)
+#   JWT_SECRET=$(openssl rand -hex 32)
+#   POSTGRES_PASSWORD=$(openssl rand -hex 24)
+# IMPORTANT: use HEX for all secrets — compose builds DATABASE_URL from
+# POSTGRES_PASSWORD, so it must be URL-safe (base64 `+`/`/` chars break Prisma).
 
 NODE_ENV=production
 NEXT_PUBLIC_WEBAPP_URL=https://cal.commonscomputer.com
@@ -15,25 +17,25 @@ CALCOM_TELEMETRY_DISABLED=1
 ORGANIZATIONS_ENABLED=false
 ALLOWED_HOSTNAMES='"cal.commonscomputer.com"'
 
-# --- postgres (compose service `database`) ---
+# --- postgres (compose service `database`; creds also drive DATABASE_URL) ---
 DATABASE_HOST=database
 POSTGRES_USER=caldiy
-POSTGRES_PASSWORD=REPLACE_ME
+POSTGRES_PASSWORD=REPLACE_ME_HEX
 POSTGRES_DB=calendso
-DATABASE_URL=postgresql://caldiy:REPLACE_ME@database/calendso
-DATABASE_DIRECT_URL=postgresql://caldiy:REPLACE_ME@database/calendso
+DATABASE_URL=postgresql://caldiy:REPLACE_ME_HEX@database/calendso
+DATABASE_DIRECT_URL=postgresql://caldiy:REPLACE_ME_HEX@database/calendso
 
 # --- auth / encryption ---
 NEXTAUTH_URL=https://cal.commonscomputer.com
-NEXTAUTH_SECRET=REPLACE_ME
-CALENDSO_ENCRYPTION_KEY=REPLACE_ME
-CALCOM_APP_CREDENTIAL_ENCRYPTION_KEY=REPLACE_ME
+NEXTAUTH_SECRET=REPLACE_ME_HEX
+CALENDSO_ENCRYPTION_KEY=REPLACE_ME_HEX
+CALCOM_APP_CREDENTIAL_ENCRYPTION_KEY=REPLACE_ME_HEX
 
 # --- redis (compose service `redis`) ---
 REDIS_URL=redis://redis:6379
 REDIS_PORT=6379
 
 # --- v2 API (calcom-api service; off for v1) ---
-JWT_SECRET=REPLACE_ME
+JWT_SECRET=REPLACE_ME_HEX
 API_KEY_PREFIX=cal_
 WEB_APP_URL=https://cal.commonscomputer.com

docker-compose.cc.yml

@@ -14,14 +14,26 @@
 #      a reserved profile — not part of the first cutover (issue #11).
 
 services:
+  # The upstream base file hardcodes database creds
+  # (unicorn_user/magical_password) and lets compose build DATABASE_URL from the
+  # raw POSTGRES_PASSWORD — both break with generated secrets. CC override:
+  # database creds come from .env, and DATABASE_URL is built consistently here.
+  # NOTE: passwords in .env MUST be URL-safe (hex) — see cc.env.example.
   database:
     image: postgres:16-alpine
+    environment:
+      POSTGRES_USER: ${POSTGRES_USER}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
+      POSTGRES_DB: ${POSTGRES_DB}
 
   redis:
     image: redis:7-alpine
 
   calcom:
     image: calcom.docker.scarf.sh/calcom/cal.diy:v6.2.0
+    environment:
+      DATABASE_URL: postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@database/${POSTGRES_DB}
+      DATABASE_DIRECT_URL: postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@database/${POSTGRES_DB}
 
   calcom-api:
     profiles: ["off"]        # v2 API — add with `--profile api` when needed