[hotfix] Prioritise API database secrets over .env

boost/factory.go

@@ -72,9 +72,9 @@ func MakeEnv(validate *pkg.Validator) *env.Environment {
 	}
 
 	db := env.DBEnvironment{
-		UserName:     env.GetEnvVar("ENV_DB_USER_NAME"),
-		UserPassword: env.GetEnvVar("ENV_DB_USER_PASSWORD"),
-		DatabaseName: env.GetEnvVar("ENV_DB_DATABASE_NAME"),
+		UserName:     env.GetSecretOrEnv("postgres_user", "ENV_DB_USER_NAME"),
+		UserPassword: env.GetSecretOrEnv("postgres_password", "ENV_DB_USER_PASSWORD"),
+		DatabaseName: env.GetSecretOrEnv("postgres_db", "ENV_DB_DATABASE_NAME"),
 		Port:         port,
 		Host:         env.GetEnvVar("ENV_DB_HOST"),
 		DriverName:   database.DriverName,

docker-compose.yml

@@ -73,12 +73,6 @@ services:
             env_file:
                 - .env
             environment:
-                # --- These variables inject the database credentials directly into the
-                #     API container at runtime. This ensures the Go application uses the
-                #     same secure credentials that the 'api-db' service is configured with.
-                ENV_DB_USER_NAME: ${ENV_DB_USER_NAME}
-                ENV_DB_USER_PASSWORD: ${ENV_DB_USER_PASSWORD}
-                ENV_DB_DATABASE_NAME: ${ENV_DB_DATABASE_NAME}
                 # --- This ensures the Go web server listens for connections from other
                 #     containers (like Caddy), not just from within itself.
                 ENV_DB_HOST: api-db
@@ -93,6 +87,10 @@ services:
                     - APP_GROUP=${ENV_DOCKER_USER_GROUP}
             container_name: oullin_api
             restart: unless-stopped
+            secrets:
+                - postgres_user
+                - postgres_password
+                - postgres_db
             depends_on:
                 api-db:
                     condition: service_healthy

env/env.go

@@ -16,3 +16,20 @@ type Environment struct {
 func GetEnvVar(key string) string {
 	return strings.TrimSpace(os.Getenv(key))
 }
+
+func GetSecretOrEnv(secretName string, envVarName string) string {
+	secretPath := "/run/secrets/" + secretName
+
+	// Try to read the secret file first.
+	content, err := os.ReadFile(secretPath)
+	if err == nil {
+		return strings.TrimSpace(string(content))
+	}
+
+	// If the file does not exist, fall back to the environment variable.
+	if os.IsNotExist(err) {
+		return GetEnvVar(envVarName) // Use your existing function here
+	}
+
+	return GetEnvVar(envVarName)
+}