# /etc/restic/dbcreds.env on esh-docker-vm — consumed by pre-backup.sh.
#
# Deploy to the host as:
#   sudo install -o root -g root -m 0600 dbcreds.env /etc/restic/dbcreds.env
#
# Never commit the real file — it carries production DB passwords. This
# template is the only thing tracked in the repo.

# --- Paperless-ngx → external Postgres on PFI-Postgres VM (10.0.50.60) ------
# NOTE (2026-04-21): the current password in the paperless-ngx compose is
# literally "paperless-ng" — trivially weak. Rotate at the DB side before
# this backup is considered secure.
PAPERLESS_PGHOST=10.0.50.60
PAPERLESS_PGPORT=5432
PAPERLESS_PGUSER=paperless-ng
PAPERLESS_PGDB=paperless-ng
PAPERLESS_PGPASS=replace-with-postgres-password

# --- All other services on this host use local SQLite ------------------------
# (home-assistant, pgadmin, uptime-kuma, calibre-web-automated)
# No external creds required — sqlite3 runs as root either on the host or
# inside the container depending on image.