modified: .gitignore

modified:   apps/gramps/docker-compose.yml
	modified:   apps/nextcloud/docker-compose.yml
	modified:   apps/passbolt/docker-compose.yml
	modified:   core/docker-compose.yml
	modified:   monitoring/gotify/docker-compose.yml
	modified:   monitoring/prometheus/docker-compose.yml
	modified:   monitoring/prometheus/prometheus.yml
	.env.example
	DEPLOYMENT.md
	SECURITY_SECRETS_INVENTORY.md
	secrets/

apps/gramps/docker-compose.yml

@@ -4,22 +4,25 @@ services:
     image: postgres:13
     container_name: gramps-db
     restart: always
+    env_file:
+      - ${PROJECT_ROOT}/secrets/stack-secrets.env
     environment:
-      POSTGRES_USER: ${GRAMPS_POSTGRES_USER}
-      POSTGRES_PASSWORD: ${GRAMPS_POSTGRES_PASSWORD}
-      POSTGRES_DB: ${GRAMPS_POSTGRES_DB}
+      POSTGRES_USER: ${GRAMPS_DB_USER}
+      POSTGRES_PASSWORD_FILE: /run/secrets/gramps_db_password
+      POSTGRES_DB: ${GRAMPS_DB_NAME}
+    secrets:
+      - gramps_db_password
     volumes:
       - ${PROJECT_ROOT}/apps/gramps/db:/var/lib/postgresql
     networks:
       - gramps
     healthcheck:
-      test: ["CMD-SHELL", "pg_isready -h db -p 5432 -U gramps -d gramps"]
+      test: ["CMD-SHELL", "pg_isready -h gramps-db -p 5432 -U $$POSTGRES_USER -d $$POSTGRES_DB"]
       interval: 10s
       timeout: 5s
       retries: 12
       start_period: 30s
 
-
   grampsweb:
     profiles: ["apps","all","gramps"]
     image: ghcr.io/gramps-project/grampsweb:latest
@@ -27,8 +30,8 @@ services:
     depends_on:
       - gramps-db
     restart: always
-#    ports:
-#      - "5000:5000"          # access via http://localhost:5000
+    env_file:
+      - ${PROJECT_ROOT}/secrets/stack-secrets.env
     environment:
       DB_URI: ${GRAMPS_DB_URI}
       GRAMPSWEB_LOGLEVEL: ${GRAMPSWEB_LOGLEVEL}
@@ -62,10 +65,9 @@ services:
       retries: 6
       start_period: 60s
 
-
-
 networks:
-#  traefik_reverse_proxy:
-#    external: true
   gramps:
-#    driver: bridge
+
+secrets:
+  gramps_db_password:
+    file: ${PROJECT_ROOT}/secrets/gramps_db_password.txt