Database and Redis

Postgres and Redis are bound to the VM's loopback. They are not on the tunnel and not published to the internet. Developers reach them over Tailscale.

psql -h evocases-iframe.taildb581b.ts.net -U evocases -d evocases
redis-cli -h evocases-iframe.taildb581b.ts.net -p 6379

The password is in Doppler, shared / stg, POSTGRES_PASSWORD:

doppler secrets get POSTGRES_PASSWORD --project shared --config stg --plain

Two things that will waste your afternoon

Do not test a password from inside the Postgres container

docker exec … psql connects over loopback, which matches a trust rule — any password succeeds there, including a wrong one. It proves nothing. Offer the credential from where a real client sits, and confirm a deliberately wrong password is refused before believing a correct one.

POSTGRES_PASSWORD is read by initdb exactly once

Changing it in Doppler later does not change the role. The order is:

ALTER USER evocases PASSWORD '<the value the config now holds>';

then the config, then restart whatever connects. The running service keeps working on pooled connections until it needs a new one, so the outage starts at the ALTER, not at the restart.

If connections stop working after a deploy

tailscale serve --tcp forwards to the host's loopback and knows nothing about containers, so the whole path depends on docker-compose.dbaccess.yml publishing those ports. It is in deploy.sh's file set — if someone removes it, tailscale serve status still lists the mapping, the tunnel and the API stay healthy, and every client gets server closed the connection unexpectedly.