From d043c10c116fdbf9c806fbec2dbb344244449e50 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Mon, 19 Oct 2026 21:20:17 +0200
Subject: [PATCH] fix(postgresql): set PGPASSWORD for healthchecks and backups
 (#12224)

---
 app/Actions/Database/StartPostgresql.php      |  7 +++++++
 ...seStartDefaultEnvironmentVariablesTest.php | 20 +++++++++++++++++++
 2 files changed, 27 insertions(+)

diff --git a/app/Actions/Database/StartPostgresql.php b/app/Actions/Database/StartPostgresql.php
index 05f9be02f9..835b0f18d4 100644
--- a/app/Actions/Database/StartPostgresql.php
+++ b/app/Actions/Database/StartPostgresql.php
@@ -263,6 +263,7 @@ class StartPostgresql
         $environment_variables = collect();
         $this->resolvedPostgresUser = (string) $this->database->postgres_user;
         $this->resolvedPostgresDatabase = (string) $this->database->postgres_db;
+        $postgresPassword = (string) $this->database->postgres_password;
         foreach ($this->database->runtime_environment_variables as $env) {
             $rawValue = (string) $this->database->resolveSecretManagerEnvironmentVariableValue($env);
             $resolvedValue = (string) $this->database->formatEnvironmentVariableValue($env, $rawValue);
@@ -273,6 +274,8 @@ class StartPostgresql
                 $this->resolvedPostgresUser = $composeFileValue;
             } elseif ($env->key === 'POSTGRES_DB') {
                 $this->resolvedPostgresDatabase = $composeFileValue;
+            } elseif ($env->key === 'POSTGRES_PASSWORD') {
+                $postgresPassword = $resolvedValue;
             }
         }
 
@@ -286,6 +289,10 @@ class StartPostgresql
         if (! $this->hasEnvironmentVariable($environment_variables, 'POSTGRES_PASSWORD')) {
             $environment_variables->push("POSTGRES_PASSWORD={$this->database->postgres_password}");
         }
+        // psql in the healthcheck, backups, and restores reads PGPASSWORD when pg_hba.conf requires a password for local connections.
+        if (! $this->hasEnvironmentVariable($environment_variables, 'PGPASSWORD')) {
+            $environment_variables->push("PGPASSWORD={$postgresPassword}");
+        }
 
         if (! $this->hasEnvironmentVariable($environment_variables, 'POSTGRES_DB')) {
             $environment_variables->push("POSTGRES_DB={$this->database->postgres_db}");
diff --git a/tests/Feature/DatabaseStartDefaultEnvironmentVariablesTest.php b/tests/Feature/DatabaseStartDefaultEnvironmentVariablesTest.php
index 33294eaf80..35694188cc 100644
--- a/tests/Feature/DatabaseStartDefaultEnvironmentVariablesTest.php
+++ b/tests/Feature/DatabaseStartDefaultEnvironmentVariablesTest.php
@@ -91,6 +91,26 @@ it('does not add a Postgres default when the user sets the exact key', function
     expect($postgresDbEntries)->toBe(['POSTGRES_DB=customdb']);
 });
 
+it('sets PGPASSWORD to the Postgres password so psql works when pg_hba.conf requires a password', function (array $userEnvironment, string $expected) {
+    $database = create_standalone_postgresql($this->environment->id, $this->destination, ['postgres_password' => 'model-secret']);
+    foreach ($userEnvironment as $key => $value) {
+        $database->runtime_environment_variables()->create(['key' => $key, 'value' => $value]);
+    }
+
+    StartPostgresql::run($database->fresh(), new Activity);
+
+    $pgPasswordEntries = collect(databaseStartComposeEnvironment($this->executor, $database->uuid))
+        ->filter(fn (string $entry) => str($entry)->startsWith('PGPASSWORD='))
+        ->values()
+        ->all();
+
+    expect($pgPasswordEntries)->toBe([$expected]);
+})->with([
+    'model password' => [[], 'PGPASSWORD=model-secret'],
+    'user POSTGRES_PASSWORD' => [['POSTGRES_PASSWORD' => 'user-secret'], 'PGPASSWORD=user-secret'],
+    'user PGPASSWORD' => [['PGPASSWORD' => 'own-secret'], 'PGPASSWORD=own-secret'],
+]);
+
 it('adds the password default when the user only sets a *_FILE variant', function (string $action, string $factory, array $data, string $userKey, string $expected) {
     $database = $factory($this->environment->id, $this->destination, $data);
     $database->runtime_environment_variables()->create(['key' => $userKey, 'value' => '/run/secrets/x']);