From d04e0ae024a51e34c65bc5fdd04628d89002235f Mon Sep 17 00:00:00 2001
From: aaverbitskiy <aaverbitskiy@gmail.com>
Date: Thu, 23 Jul 2026 05:19:13 +0000
Subject: [PATCH] db creds: move ClickHouse user/password to gitignored .env
 via compose env_file; drop hardcoded default from main.py

---
 .gitignore         | 1 +
 docker-compose.yml | 2 ++
 main.py            | 4 +++-
 3 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/.gitignore b/.gitignore
index bb3857d..f59a7ef 100644
--- a/.gitignore
+++ b/.gitignore
@@ -6,3 +6,4 @@ __pycache__/
 static/assets/
 static/index.html
 static/next/
+.env
diff --git a/docker-compose.yml b/docker-compose.yml
index 4cf722d..07f2e89 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -5,6 +5,8 @@ services:
     container_name: mapdash
     restart: unless-stopped
     networks: [edge]
+    env_file:
+      - .env
     volumes:
       - ./static:/app/static:ro
 networks:
diff --git a/main.py b/main.py
index d2016af..100cadf 100644
--- a/main.py
+++ b/main.py
@@ -7,7 +7,9 @@ from fastapi.staticfiles import StaticFiles
 CH_HOST = os.environ.get("CLICKHOUSE_HOST", "ClickHouse")
 CH_PORT = os.environ.get("CLICKHOUSE_PORT", "8123")
 CH_USER = os.environ.get("CLICKHOUSE_USER", "default")
-CH_PASSWORD = os.environ.get("CLICKHOUSE_PASSWORD", "1234567890")
+# Credentials come from the environment (see .env / docker-compose env_file).
+# No secret is kept in source; empty default fails fast if the env is missing.
+CH_PASSWORD = os.environ.get("CLICKHOUSE_PASSWORD", "")
 CH_URL = f"http://{CH_HOST}:{CH_PORT}/"
 
 app = FastAPI()