fix: Properly distribute analytics postgres user

.github/workflows/provision.yml

@@ -126,8 +126,8 @@ jobs:
           dockerhub_password: ${{ secrets.DOCKER_TOKEN }}
           mongodb_admin_username: ${{ secrets.MONGODB_ADMIN_USER }}
           mongodb_admin_password: ${{ secrets.MONGODB_ADMIN_PASSWORD }}
-          postgres_user: ${{ secrets.ANALYTICS_POSTGRES_USER }}
-          postgres_password: ${{ secrets.ANALYTICS_POSTGRES_PASSWORD }}
+          postgres_user: ${{ secrets.POSTGRES_USER }}
+          postgres_password: ${{ secrets.POSTGRES_PASSWORD }}
           backup_encryption_passphrase: ${{ secrets.BACKUP_ENCRYPTION_PASSPHRASE }}
           elasticsearch_superuser_password: ${{ secrets.ELASTICSEARCH_SUPERUSER_PASSWORD }}
           # SSH_HOST was moved from a secret to a variable in OpenCRVS 1.5.0

infrastructure/backups/backup.sh

@@ -202,22 +202,22 @@ done
 
 echo "Backing up PostgreSQL 'events' database"
 docker run --rm \
-  -e PGPASSWORD=$ANALYTICS_POSTGRES_PASSWORD \
+  -e PGPASSWORD=$POSTGRES_PASSWORD \
   -v $ROOT_PATH/backups/postgres:/backups \
   --network=$NETWORK \
   postgres:17 \
-  bash -c "pg_dump -h postgres -U $ANALYTICS_POSTGRES_USER -d events -F c -f /backups/events-${LABEL:-$BACKUP_DATE}.dump"
+  bash -c "pg_dump -h postgres -U $POSTGRES_USER -d events -F c -f /backups/events-${LABEL:-$BACKUP_DATE}.dump"
 
 # Backup PostgreSQL
 # -----------------
 
 echo "Backing up PostgreSQL 'events' database"
 docker run --rm \
-  -e PGPASSWORD=$ANALYTICS_POSTGRES_PASSWORD \
+  -e PGPASSWORD=$POSTGRES_PASSWORD \
   -v $ROOT_PATH/backups/postgres:/backups \
   --network=$NETWORK \
   postgres:17 \
-  bash -c "pg_dump -h postgres -U $ANALYTICS_POSTGRES_USER -d events -F c -f /backups/events-${LABEL:-$BACKUP_DATE}.dump"
+  bash -c "pg_dump -h postgres -U $POSTGRES_USER -d events -F c -f /backups/events-${LABEL:-$BACKUP_DATE}.dump"
 
 #-------------------------------------------------------------------------------------
 

infrastructure/backups/restore.sh

@@ -190,10 +190,10 @@ db.getSiblingDB('webhooks').dropDatabase();"
 ##
 
 docker run --rm \
-  -e PGPASSWORD=$ANALYTICS_POSTGRES_PASSWORD \
+  -e PGPASSWORD=$POSTGRES_PASSWORD \
   --network=$NETWORK \
   postgres:17.6 \
-  bash -c "psql -h postgres -U $ANALYTICS_POSTGRES_USER -c 'DROP DATABASE IF EXISTS events;'"
+  bash -c "psql -h postgres -U $POSTGRES_USER -c 'DROP DATABASE IF EXISTS events;'"
 
 #####
 #
@@ -222,11 +222,11 @@ docker run --rm -v $ROOT_PATH/backups/mongo:/data/backups/mongo --network=$NETWO
 
 echo "Restoring PostgreSQL 'events' database"
 docker run --rm \
-  -e PGPASSWORD=$ANALYTICS_POSTGRES_PASSWORD \
+  -e PGPASSWORD=$POSTGRES_PASSWORD \
   -v $ROOT_PATH/backups/postgres:/backups \
   --network=$NETWORK \
   postgres:17.6 \
-  bash -c "createdb -h postgres -U $ANALYTICS_POSTGRES_USER events && pg_restore -h postgres -U $ANALYTICS_POSTGRES_USER -d events /backups/events-${LABEL}.dump"
+  bash -c "createdb -h postgres -U $POSTGRES_USER events && pg_restore -h postgres -U $POSTGRES_USER -d events /backups/events-${LABEL}.dump"
 
 ##
 # ------ ELASTICSEARCH -----

infrastructure/deployment/deploy.sh

@@ -357,8 +357,8 @@ export WEBHOOKS_REDIS_PASSWORD=`generate_password`
 export EVENTS_APP_POSTGRES_PASSWORD=`generate_password`
 export EVENTS_MIGRATOR_POSTGRES_PASSWORD=`generate_password`
 export ANALYTICS_POSTGRES_PASSWORD=`generate_password`
+export ANALYTICS_POSTGRES_USER=`generate_password`
 
-#
 # Elasticsearch credentials
 #
 # Notice that all of these passwords change on each deployment.

infrastructure/environments/setup-environment.ts

@@ -702,15 +702,15 @@ const derivedVariables = [
     scope: 'ENVIRONMENT'
   },
   {
-    name: 'ANALYTICS_POSTGRES_USER',
-    valueLabel: 'ANALYTICS_POSTGRES_USER',
+    name: 'POSTGRES_USER',
+    valueLabel: 'POSTGRES_USER',
     valueType: 'SECRET',
     type: 'disabled',
     scope: 'ENVIRONMENT'
   },
   {
-    name: 'ANALYTICS_POSTGRES_PASSWORD',
-    valueLabel: 'ANALYTICS_POSTGRES_PASSWORD',
+    name: 'POSTGRES_PASSWORD',
+    valueLabel: 'POSTGRES_PASSWORD',
     valueType: 'SECRET',
     type: 'disabled',
     scope: 'ENVIRONMENT'
@@ -1224,40 +1224,6 @@ const SPECIAL_NON_APPLICATION_ENVIRONMENTS = ['jump', 'backup']
       ),
       scope: 'ENVIRONMENT' as const
     },
-    {
-      name: 'ANALYTICS_POSTGRES_USER',
-      type: 'SECRET' as const,
-      didExist: findExistingValue(
-        'ANALYTICS_POSTGRES_USER',
-        'SECRET',
-        'ENVIRONMENT',
-        existingValues
-      ),
-      value: findExistingOrDefine(
-        'ANALYTICS_POSTGRES_USER',
-        'SECRET',
-        'ENVIRONMENT',
-        generateLongPassword()
-      ),
-      scope: 'ENVIRONMENT' as const
-    },
-    {
-      name: 'ANALYTICS_POSTGRES_PASSWORD',
-      type: 'SECRET' as const,
-      didExist: findExistingValue(
-        'ANALYTICS_POSTGRES_PASSWORD',
-        'SECRET',
-        'ENVIRONMENT',
-        existingValues
-      ),
-      value: findExistingOrDefine(
-        'ANALYTICS_POSTGRES_PASSWORD',
-        'SECRET',
-        'ENVIRONMENT',
-        generateLongPassword()
-      ),
-      scope: 'ENVIRONMENT' as const
-    },
     {
       name: 'POSTGRES_USER',
       type: 'SECRET' as const,

infrastructure/server-setup/tasks/data-partition.yml

@@ -256,7 +256,7 @@
     content: |
       MONGODB_ADMIN_PASSWORD={{ mongodb_admin_password }}
       MONGODB_ADMIN_USER={{ mongodb_admin_username }}
-      ANALYTICS_POSTGRES_USER={{ postgres_user }}
-      ANALYTICS_POSTGRES_PASSWORD={{ postgres_password }}
+      POSTGRES_USER={{ postgres_user }}
+      POSTGRES_PASSWORD={{ postgres_password }}
       ELASTICSEARCH_ADMIN_PASSWORD={{elasticsearch_superuser_password}}
       ELASTICSEARCH_ADMIN_USER=elastic