fix(security): remove hardcoded secrets from infrastructure files

- Replace base64-encoded credentials in k8s/secret.yaml with placeholders
- Use ${POSTGRES_PASSWORD:-changeme} env var references in docker-compose
- Remove default "changeme" from Helm secret template (now required)
- Use ${AIRFLOW_POSTGRES_PASSWORD} and ${AIRFLOW_ADMIN_PASSWORD} in Airflow compose

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: hsinnearth7

docker-compose.yml

@@ -9,7 +9,7 @@ services:
       - CC_LOG_LEVEL=INFO
       - CC_ENABLE_CAUSAL_ANALYSIS=false
       - CC_ENABLE_CHRONOS=false
-      - DATABASE_URL=postgresql://chaincommand:changeme@postgres:5432/chaincommand
+      - DATABASE_URL=postgresql://chaincommand:${POSTGRES_PASSWORD:-changeme}@postgres:5432/chaincommand
       - REDIS_URL=redis://redis:6379/0
     volumes:
       - ./data:/app/data
@@ -25,7 +25,7 @@ services:
     environment:
       POSTGRES_DB: chaincommand
       POSTGRES_USER: chaincommand
-      POSTGRES_PASSWORD: changeme
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-changeme}
     ports:
       - "5432:5432"
     volumes:

helm/chaincommand/templates/secret.yaml

@@ -8,4 +8,5 @@ type: Opaque
 data:
   CC_API_KEY: {{ .Values.secrets.apiKey | b64enc | quote }}
   CC_OPENAI_API_KEY: {{ .Values.secrets.openaiApiKey | b64enc | quote }}
-  POSTGRES_PASSWORD: {{ default "changeme" .Values.postgresql.auth.existingSecret | b64enc | quote }}
+  # POSTGRES_PASSWORD: Set via .Values.postgresql.auth.existingSecret or override in values.yaml
+  POSTGRES_PASSWORD: {{ required "postgresql.auth.existingSecret must be set" .Values.postgresql.auth.existingSecret | b64enc | quote }}

k8s/secret.yaml

@@ -7,8 +7,8 @@ metadata:
     app.kubernetes.io/name: chaincommand
 type: Opaque
 data:
-  CC_API_KEY: Y2hhbmdlLW1lLWFwaS1rZXk=
-  CC_OPENAI_API_KEY: Y2hhbmdlLW1lLW9wZW5haS1rZXk=
-  DATABASE_URL: cG9zdGdyZXNxbDovL2NoYWluY29tbWFuZDpjaGFuZ2VtZUBwb3N0Z3Jlczo1NDMyL2NoYWluY29tbWFuZA==
-  REDIS_URL: cmVkaXM6Ly9yZWRpczo2Mzc5LzA=
-  POSTGRES_PASSWORD: Y2hhbmdlbWU=
+  CC_API_KEY: REPLACE_WITH_BASE64_ENCODED_VALUE
+  CC_OPENAI_API_KEY: REPLACE_WITH_BASE64_ENCODED_VALUE
+  DATABASE_URL: REPLACE_WITH_BASE64_ENCODED_VALUE
+  REDIS_URL: REPLACE_WITH_BASE64_ENCODED_VALUE
+  POSTGRES_PASSWORD: REPLACE_WITH_BASE64_ENCODED_VALUE

pipelines/docker-compose.airflow.yaml

@@ -3,7 +3,7 @@ services:
     image: apache/airflow:2.9.0-python3.11
     environment:
       AIRFLOW__CORE__EXECUTOR: LocalExecutor
-      AIRFLOW__DATABASE__SQL_ALCHEMY_CONN: postgresql+psycopg2://airflow:airflow@airflow-postgres:5432/airflow
+      AIRFLOW__DATABASE__SQL_ALCHEMY_CONN: postgresql+psycopg2://airflow:${AIRFLOW_POSTGRES_PASSWORD:-airflow}@airflow-postgres:5432/airflow
       AIRFLOW__CORE__FERNET_KEY: ""
       AIRFLOW__CORE__DAGS_ARE_PAUSED_AT_CREATION: "true"
       AIRFLOW__CORE__LOAD_EXAMPLES: "false"
@@ -22,7 +22,7 @@ services:
     image: apache/airflow:2.9.0-python3.11
     environment:
       AIRFLOW__CORE__EXECUTOR: LocalExecutor
-      AIRFLOW__DATABASE__SQL_ALCHEMY_CONN: postgresql+psycopg2://airflow:airflow@airflow-postgres:5432/airflow
+      AIRFLOW__DATABASE__SQL_ALCHEMY_CONN: postgresql+psycopg2://airflow:${AIRFLOW_POSTGRES_PASSWORD:-airflow}@airflow-postgres:5432/airflow
       AIRFLOW__CORE__FERNET_KEY: ""
       AIRFLOW__CORE__LOAD_EXAMPLES: "false"
     volumes:
@@ -38,7 +38,7 @@ services:
     image: postgres:16-alpine
     environment:
       POSTGRES_USER: airflow
-      POSTGRES_PASSWORD: airflow
+      POSTGRES_PASSWORD: ${AIRFLOW_POSTGRES_PASSWORD:-airflow}
       POSTGRES_DB: airflow
     volumes:
       - airflow-db:/var/lib/postgresql/data
@@ -52,12 +52,12 @@ services:
   airflow-init:
     image: apache/airflow:2.9.0-python3.11
     environment:
-      AIRFLOW__DATABASE__SQL_ALCHEMY_CONN: postgresql+psycopg2://airflow:airflow@airflow-postgres:5432/airflow
+      AIRFLOW__DATABASE__SQL_ALCHEMY_CONN: postgresql+psycopg2://airflow:${AIRFLOW_POSTGRES_PASSWORD:-airflow}@airflow-postgres:5432/airflow
     command: >
       bash -c "airflow db init &&
       airflow users create
       --username admin
-      --password admin
+      --password $${AIRFLOW_ADMIN_PASSWORD:-admin}
       --firstname Admin
       --lastname User
       --role Admin