fix(nix,postgres): set role password safely for any value

The password was interpolated into the SQL string as '$DATABASE_PASS', which breaks (and risks SQL injection) for passwords containing single quotes. Read it from the environment with psql's \getenv and quote it with :'password', producing a correctly escaped SQL string literal. The password is no longer placed on the command line either. Requires PostgreSQL >= 14 for \getenv.

Author: JakobLichterfeld

CHANGELOG.md

@@ -9,6 +9,7 @@
 - fix(webview): show charging finish time in browser local time (#5436 - @Ashok28)
 - refactor(nix,postgres): provision database declaratively, connect via socket (#5337 - @JakobLichterfeld)
 - fix(nix,maintenance): read RELEASE_COOKIE without sourcing the env file (#5337 - @JakobLichterfeld)
+- fix(nix,postgres): set role password safely for any value (#5337 - @JakobLichterfeld)
 
 #### Build, CI, internal
 

nix/module.nix

@@ -277,8 +277,15 @@ in
       # hook there (after the role exists) and scope the secret to that unit.
       systemd.services.postgresql-setup = {
         serviceConfig.EnvironmentFile = cfg.secretsFile;
+        # Read the password from the environment with psql's \getenv (so it is
+        # never placed on the command line or shell-expanded) and quote it with
+        # :'password', which produces a correctly escaped SQL string literal.
+        # This is safe for any password, including ones containing single
+        # quotes. Requires PostgreSQL >= 14 for \getenv.
         postStart = ''
-          psql -tAc "ALTER USER \"${cfg.postgres.user}\" WITH ENCRYPTED PASSWORD '$DATABASE_PASS'"
+          psql -v ON_ERROR_STOP=1 -d postgres \
+            -c '\getenv password DATABASE_PASS' \
+            -c "ALTER USER \"${cfg.postgres.user}\" WITH ENCRYPTED PASSWORD :'password'"
         '';
       };
     })