From 888523079f1ae9dab868430450d6939833a0e59a Mon Sep 17 00:00:00 2001
From: Thierry Pouplier <thierrypouplier@gmail.com>
Date: Fri, 18 Sep 2026 16:23:28 -0400
Subject: [PATCH] hermes: route all dashboard/honcho secrets through age-backed
 env (no hardcoded values for public repo); add main-dash auth env

---
 ai/compose.yml | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/ai/compose.yml b/ai/compose.yml
index 647a105..d3cc549 100755
--- a/ai/compose.yml
+++ b/ai/compose.yml
@@ -25,6 +25,9 @@ services:
     - TZ=America/Montreal
     - CATHOU_SERVE_PASSWORD=${CATHOU_SERVE_PASSWORD:?must be set}
     - CATHOU_SERVE_SECRET=${CATHOU_SERVE_SECRET:?must be set}
+    - HERMES_DASHBOARD_BASIC_AUTH_USERNAME=thierry
+    - HERMES_DASHBOARD_BASIC_AUTH_PASSWORD=${HERMES_DASHBOARD_BASIC_AUTH_PASSWORD:?must be set}
+    - HERMES_DASHBOARD_BASIC_AUTH_SECRET=${HERMES_DASHBOARD_BASIC_AUTH_SECRET:?must be set}
     volumes:
     - /mnt/HoardingCow_docker_data/Hermes/data:/opt/data
     - /mnt/HoardingCow_docker_data/Hermes/Syncthing/ExoKortex:/opt/data/ExoKortex
@@ -141,7 +144,7 @@ services:
     container_name: honcho
     restart: unless-stopped
     environment:
-    - DB_CONNECTION_URI=postgresql+psycopg://honcho:honcho_pass@honcho-db:5432/honcho
+    - DB_CONNECTION_URI=postgresql+psycopg://honcho:${HONCHO_DB_PASSWORD:?HONCHO_DB_PASSWORD must be set}@honcho-db:5432/honcho
     - CACHE_URL=redis://honcho-redis:6379/0
     - CACHE_ENABLED=true
     - EMBEDDING_VECTOR_DIMENSIONS=1024
@@ -182,7 +185,7 @@ services:
     environment:
     - POSTGRES_DB=honcho
     - POSTGRES_USER=honcho
-    - POSTGRES_PASSWORD=honcho_pass
+    - POSTGRES_PASSWORD=${HONCHO_DB_PASSWORD:?HONCHO_DB_PASSWORD must be set}
     - PGDATA=/var/lib/postgresql/data/pgdata
     volumes:
     - /mnt/HoardingCow_docker_data/Honcho/postgres:/var/lib/postgresql/data