security: Replace hardcoded DB_PASSWORD in docker-compose development configs

[YaronZaki]

Problem Statement

Four docker-compose files and two CI workflows hardcode DB_PASSWORD=password and POSTGRES_PASSWORD=password. Production config (docker-compose.quantara.yaml) correctly uses ${DB_PASSWORD} but dev configs use literal strings.

Evidence

• devops/docker-compose.quantara.dev.yaml:30 — DB_PASSWORD=password
• devops/docker-compose.quantara.back.yaml:32 — DB_PASSWORD=password
• devops/docker-compose.quantara.dev-windows.yaml:30 — DB_PASSWORD=password
• .github/workflows/ci.yml:37,52 — POSTGRES_PASSWORD: password, DB_PASSWORD: password
• .github/workflows/integration-tests.yml:37,52 — same pattern

# Production config correctly uses env var (docker-compose.quantara.yaml:50):
POSTGRES_PASSWORD: ${DB_PASSWORD}

Impact

High — credential leakage risk. If a developer copies dev config pattern to production, database has known password "password". CI passwords could appear in build logs accessible to anyone with repo access. Inconsistency between dev/prod creates confusion.

Proposed Solution

Change all dev docker-compose files to use ${DB_PASSWORD:-password} syntax, providing default fallback but reading from environment if set. Adds DB_PASSWORD=password to .env.dev for explicit dev defaults.

Acceptance Criteria

• All four docker-compose dev files use ${DB_PASSWORD:-password} instead of hardcoded password
• .env.dev contains DB_PASSWORD=password
• make dev still works without additional configuration
• CI workflows continue to pass

File Map

• devops/docker-compose.quantara.dev.yaml:30 — change to ${DB_PASSWORD:-password}
• devops/docker-compose.quantara.back.yaml:32 — same change
• devops/docker-compose.quantara.dev-windows.yaml:30 — same change
• quantara/.env.dev — ensure DB_PASSWORD=password set

Testing Strategy

• Integration: Run docker compose -f devops/docker-compose.quantara.dev.yaml up -d with and without DB_PASSWORD env var
• Manual: Set DB_PASSWORD=testpass, run compose, verify PostgreSQL receives testpass

Security Considerations

Medium improvement. Establishes consistent env-var-driven pattern across all environments. Dev default of password acceptable for local dev only (database not exposed externally).

Definition of Done

• Code implemented and peer-reviewed
• Dev environment verified working (make dev)
• Documentation updated if needed
• PR linked and merged

---

Labels: security, quick-win
Priority: High
Difficulty: Beginner
Estimated Effort: 1h

[samieazubike]

Hi maintainer! Kindly assign the issue to me. I can create a PR within 12hr

[samieazubike]

Hi maintainer! Kindly assign the issue to me. I can create a PR within 12hr

[NteinPrecious]

hey maintainer, i have gone thru this issue and know what to be done, can i take this up?

[grantfox-oss]

🦊 GrantFox — @NteinPrecious has been assigned to this issue as part of the Official Campaign campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #43)
2. Your PR will be reviewed by the Quantarq maintainers

Good luck! Track your progress on GrantFox.

[grantfox-oss]

🎉 This issue has been marked as completed on GrantFox as part of the Official Campaign campaign!

@NteinPrecious's PR #144 was approved and merged by @YaronZaki.

🏆 @NteinPrecious: You earned 35 FoxPoints for this contribution! Your current tier: Explorer (153 total points). Track your full progress on GrantFox.

👏 Great work, @NteinPrecious! Keep contributing to Quantarq.