From 1c3c661726f211bbe63f63d2ef12a908e3876cae Mon Sep 17 00:00:00 2001
From: hausgeist <hausgeist@bringyourown.computer>
Date: Mon, 28 Sep 2026 06:44:44 -0700
Subject: [PATCH] =?UTF-8?q?cc:=20fix=20DB=20wiring=20=E2=80=94=20base=20co?=
 =?UTF-8?q?mpose=20hardcodes=20unicorn=5Fuser/magical=5Fpassword=20and=20b?=
 =?UTF-8?q?uilds=20DATABASE=5FURL=20from=20raw=20creds=20(Prisma=20URL-par?=
 =?UTF-8?q?se=20crash=20with=20base64=20pw)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- docker-compose.cc.yml: database env + calcom DATABASE_URL/DIRECT_URL from .env
- cc.env.example: require HEX (URL-safe) secrets; hex generation commands
---
 cc.env.example        | 28 +++++++++++++++-------------
 docker-compose.cc.yml | 12 ++++++++++++
 2 files changed, 27 insertions(+), 13 deletions(-)

diff --git a/cc.env.example b/cc.env.example
index 09e3fe28bc..659024bc90 100644
--- a/cc.env.example
+++ b/cc.env.example
@@ -2,11 +2,13 @@
 # Template spec for the production `.env`; ansible renders `.env` from the
 # cc-ansible vault (group_vars/cc_apps/vault.yml) — keep the two in sync.
 # Never commit the real `.env`. Generate secrets with:
-#   NEXTAUTH_SECRET=$(openssl rand -base64 32)
-#   CALENDSO_ENCRYPTION_KEY=$(openssl rand -base64 24)
-#   CALCOM_APP_CREDENTIAL_ENCRYPTION_KEY=$(openssl rand -base64 32)
-#   JWT_SECRET=$(openssl rand -base64 32)
-#   POSTGRES_PASSWORD=$(openssl rand -base64 24)
+#   NEXTAUTH_SECRET=$(openssl rand -hex 32)
+#   CALENDSO_ENCRYPTION_KEY=$(openssl rand -hex 24)
+#   CALCOM_APP_CREDENTIAL_ENCRYPTION_KEY=$(openssl rand -hex 32)
+#   JWT_SECRET=$(openssl rand -hex 32)
+#   POSTGRES_PASSWORD=$(openssl rand -hex 24)
+# IMPORTANT: use HEX for all secrets — compose builds DATABASE_URL from
+# POSTGRES_PASSWORD, so it must be URL-safe (base64 `+`/`/` chars break Prisma).
 
 NODE_ENV=production
 NEXT_PUBLIC_WEBAPP_URL=https://cal.commonscomputer.com
@@ -15,25 +17,25 @@ CALCOM_TELEMETRY_DISABLED=1
 ORGANIZATIONS_ENABLED=false
 ALLOWED_HOSTNAMES='"cal.commonscomputer.com"'
 
-# --- postgres (compose service `database`) ---
+# --- postgres (compose service `database`; creds also drive DATABASE_URL) ---
 DATABASE_HOST=database
 POSTGRES_USER=caldiy
-POSTGRES_PASSWORD=REPLACE_ME
+POSTGRES_PASSWORD=REPLACE_ME_HEX
 POSTGRES_DB=calendso
-DATABASE_URL=postgresql://caldiy:REPLACE_ME@database/calendso
-DATABASE_DIRECT_URL=postgresql://caldiy:REPLACE_ME@database/calendso
+DATABASE_URL=postgresql://caldiy:REPLACE_ME_HEX@database/calendso
+DATABASE_DIRECT_URL=postgresql://caldiy:REPLACE_ME_HEX@database/calendso
 
 # --- auth / encryption ---
 NEXTAUTH_URL=https://cal.commonscomputer.com
-NEXTAUTH_SECRET=REPLACE_ME
-CALENDSO_ENCRYPTION_KEY=REPLACE_ME
-CALCOM_APP_CREDENTIAL_ENCRYPTION_KEY=REPLACE_ME
+NEXTAUTH_SECRET=REPLACE_ME_HEX
+CALENDSO_ENCRYPTION_KEY=REPLACE_ME_HEX
+CALCOM_APP_CREDENTIAL_ENCRYPTION_KEY=REPLACE_ME_HEX
 
 # --- redis (compose service `redis`) ---
 REDIS_URL=redis://redis:6379
 REDIS_PORT=6379
 
 # --- v2 API (calcom-api service; off for v1) ---
-JWT_SECRET=REPLACE_ME
+JWT_SECRET=REPLACE_ME_HEX
 API_KEY_PREFIX=cal_
 WEB_APP_URL=https://cal.commonscomputer.com
\ No newline at end of file
diff --git a/docker-compose.cc.yml b/docker-compose.cc.yml
index 6879eb5757..d3f2a0a2ba 100644
--- a/docker-compose.cc.yml
+++ b/docker-compose.cc.yml
@@ -14,14 +14,26 @@
 #      a reserved profile — not part of the first cutover (issue #11).
 
 services:
+  # The upstream base file hardcodes database creds
+  # (unicorn_user/magical_password) and lets compose build DATABASE_URL from the
+  # raw POSTGRES_PASSWORD — both break with generated secrets. CC override:
+  # database creds come from .env, and DATABASE_URL is built consistently here.
+  # NOTE: passwords in .env MUST be URL-safe (hex) — see cc.env.example.
   database:
     image: postgres:16-alpine
+    environment:
+      POSTGRES_USER: ${POSTGRES_USER}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
+      POSTGRES_DB: ${POSTGRES_DB}
 
   redis:
     image: redis:7-alpine
 
   calcom:
     image: calcom.docker.scarf.sh/calcom/cal.diy:v6.2.0
+    environment:
+      DATABASE_URL: postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@database/${POSTGRES_DB}
+      DATABASE_DIRECT_URL: postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@database/${POSTGRES_DB}
 
   calcom-api:
     profiles: ["off"]        # v2 API — add with `--profile api` when needed