security: remove hardcoded secrets, require env vars

Remove hardcoded encryption fallback and Postgres password defaults
flagged by GitGuardian. ENCRYPTION_SECRET and DATABASE_URL are now
required env vars that throw on missing rather than falling back to
insecure defaults.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

docker-compose.standalone.yml

@@ -19,7 +19,7 @@ x-standalone-base: &standalone-base
   environment: &base-env
     NODE_ENV: production
     PORT: "3000"
-    DATABASE_URL: postgres://rspace:${POSTGRES_PASSWORD:-rspace}@rspace-db:5432/rspace
+    DATABASE_URL: postgres://rspace:${POSTGRES_PASSWORD}@rspace-db:5432/rspace
   depends_on:
     rspace-db:
       condition: service_healthy

docker-compose.yml

@@ -27,7 +27,7 @@ services:
       - INFISICAL_PROJECT_SLUG=rspace
       - INFISICAL_ENV=prod
       - INFISICAL_URL=http://infisical:8080
-      - DATABASE_URL=postgres://rspace:${POSTGRES_PASSWORD:-rspace}@rspace-db:5432/rspace
+      - DATABASE_URL=postgres://rspace:${POSTGRES_PASSWORD}@rspace-db:5432/rspace
       - FLOW_SERVICE_URL=http://payment-flow:3010
       - FLOW_ID=a79144ec-e6a2-4e30-a42a-6d8237a5953d
       - FUNNEL_ID=0ff6a9ac-1667-4fc7-9a01-b1620810509f
@@ -155,7 +155,7 @@ services:
     environment:
       - POSTGRES_DB=rspace
       - POSTGRES_USER=rspace
-      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD:-rspace}
+      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
     healthcheck:
       test: ["CMD-SHELL", "pg_isready -U rspace"]
       interval: 5s

server/community-store.ts

@@ -904,7 +904,10 @@ export function setEncryption(
  * For now, uses a deterministic HMAC-based key from a server secret.
  */
 async function deriveSpaceKey(keyId: string): Promise<CryptoKey> {
-	const serverSecret = process.env.ENCRYPTION_SECRET || 'rspace-dev-secret-change-in-production';
+	const serverSecret = process.env.ENCRYPTION_SECRET;
+	if (!serverSecret) {
+		throw new Error('ENCRYPTION_SECRET environment variable is required');
+	}
 	const encoder = new TextEncoder();
 	const keyMaterial = await crypto.subtle.importKey(
 		'raw',

server/local-first/migration/dry-run.ts

@@ -20,8 +20,10 @@ import {
   type MigrationResult,
 } from './pg-to-automerge';
 
-const DATABASE_URL =
-  process.env.DATABASE_URL || 'postgres://rspace:rspace@rspace-db:5432/rspace';
+const DATABASE_URL = process.env.DATABASE_URL;
+if (!DATABASE_URL) {
+  throw new Error('DATABASE_URL environment variable is required');
+}
 
 const sql = postgres(DATABASE_URL, { max: 5, idle_timeout: 10 });
 

server/local-first/migration/run-migration.ts

@@ -19,8 +19,10 @@ import {
 import { syncServer } from '../../sync-instance';
 import { loadAllDocs, docIdToPath } from '../doc-persistence';
 
-const DATABASE_URL =
-  process.env.DATABASE_URL || 'postgres://rspace:rspace@rspace-db:5432/rspace';
+const DATABASE_URL = process.env.DATABASE_URL;
+if (!DATABASE_URL) {
+  throw new Error('DATABASE_URL environment variable is required');
+}
 
 const sql = postgres(DATABASE_URL, { max: 5, idle_timeout: 10 });
 

shared/db/pool.ts

@@ -7,8 +7,10 @@
 
 import postgres from "postgres";
 
-const DATABASE_URL =
-	process.env.DATABASE_URL || "postgres://rspace:rspace@rspace-db:5432/rspace";
+const DATABASE_URL = process.env.DATABASE_URL;
+if (!DATABASE_URL) {
+	throw new Error("DATABASE_URL environment variable is required");
+}
 
 /** Global shared connection */
 export const sql = postgres(DATABASE_URL, {