Expert
The password in docker service inspect
The security audit is clear (security/audit-2026-10.md): the database password sits in stack.yaml, in docker service inspect and in the environment of every container. Get it out of all of them. The password itself does not change today, and the shop must keep serving its 48 210 orders.
Your terminal is on manager-1 (drained). The API runs on the workers; postgres runs on worker-1, where its data lives. Your shell exports the password as DB_PASSWORD (the ops login profile reads it from the vault). shop-api accepts DATABASE_PASSWORD or DATABASE_PASSWORD_FILE (api/src/config.js). The test calls http://<cluster>/products every minute for two hours, then counts the orders.
What your server must hold
- security.secretsInEnv = 0
- Availability ≥ 99 %
- No record lost