Fix pgbouncer scram-sha-256 auth and document Postgres prod env vars

Two real bugs hit during tonight's first production deploy (found and
fixed live on the server, folded back into the tracked config so the
next deploy doesn't hit either wall):

1. pgbouncer defaults to md5 auth; postgres:17-alpine defaults password_encryption
   to scram-sha-256. Every connection failed with "wrong password type"
   until AUTH_TYPE=scram-sha-256 was set explicitly on the pgbouncer service.

2. POSTGRES_USER/PASSWORD/DB were never documented anywhere (not in
   .env.example, despite docker-compose.prod.yml requiring them) --
   added, with a note against `openssl rand -base64` for the password
   specifically: its output can contain /+=, which breaks pgbouncer's
   (and any DATABASE_URL parser's) naive URL parsing. Pointed at
   token_urlsafe instead, matching the other generated secrets.

Co-Authored-By: Claude Sonnet 5 <[email protected]>

.env.example

@@ -49,3 +49,14 @@ RATE_LIMIT_PER_MINUTE=120
 MEDIA_ROOT=./media
 MEDIA_URL_PREFIX=/media
 ARTWORK_DOWNLOAD_MAX_BYTES=15728640
+
+# --- Production only (docker-compose.prod.yml) ---
+# Not used by docker-compose.yml (local dev) or the app itself directly --
+# only interpolated into the postgres/pgbouncer service definitions.
+# Generate POSTGRES_PASSWORD with a URL-safe generator, not `openssl rand
+# -base64`: base64 output can contain `/+=`, which breaks pgbouncer's (and
+# any DATABASE_URL parser's) naive URL parsing.
+POSTGRES_USER=aurora
+# python3 -c "import secrets; print(secrets.token_urlsafe(32))"
+POSTGRES_PASSWORD=changeme-generate-a-real-password
+POSTGRES_DB=aurora_core

README.md

@@ -184,8 +184,9 @@ once the subdomain exists and DNS resolves).
    either cPanel/WHM's Application Manager if available, or a custom
    Apache/LiteSpeed vhost include (`ProxyPass`/`ProxyPassReverse` for
    Apache; LiteSpeed's External App + rewrite rule for LiteSpeed).
-3. **`.env`** on the server (never committed), beyond the base vars in
+3. **`.env`** on the server (never committed) — fill in every value in
-   `.env.example`:
+   `.env.example`, including the "Production only" section at the bottom
+   (`POSTGRES_USER`/`PASSWORD`/`DB`), plus:
 
    ```bash
    CORS_ORIGINS=https://www.amdbs.net  # must include the frontend's real origin

docker-compose.prod.yml

@@ -39,6 +39,10 @@ services:
       POOL_MODE: transaction
       MAX_CLIENT_CONN: "1000"
       DEFAULT_POOL_SIZE: "25"
+      # postgres:17-alpine defaults password_encryption to scram-sha-256;
+      # pgbouncer defaults auth_type to md5, which then fails every
+      # connection with "wrong password type" against a scram-only server.
+      AUTH_TYPE: scram-sha-256
     depends_on:
       postgres:
         condition: service_healthy