immich-app/immich
1
0
Fork 0
mirror of https://github.com/immich-app/immich.git synced 2026-07-25 14:00:45 +03:00
Code Issues 783 Packages Projects Releases 22 Wiki Activity

DB Password Seems Hardcoded? #7429

New Issue
Closed
opened 2026-02-05 13:01:58 +03:00 by OVERLORD · 0 comments
OVERLORD commented 2026-02-05 13:01:58 +03:00
Owner
Copy Link

Originally created by @ksparham on GitHub (Oct 4, 2025).

I have searched the existing issues, both open and closed, to make sure this is not a duplicate report.

  • Yes

The bug

So, I've been having an issue after restarting my stack on Portainer -- I kept getting a password error and after spending a few hours trying to figure out what on earth was wrong, I created a fresh stack and... same error.

I regret not copying the errors, but they were postgre scram errors as well as invalid password errors.

I'm running Immich docker via Portainer, inside a Proxmox LXC. Data is being saved to an iSCSI connection on NAS, database was being stored locally in the LXC.

I acknowledge it may be a configuration/set up issue on my end, but it's odd how reliable I've been able to reproduce it.

The OS that Immich Server is running on

Ubuntu 22.04 LTS

Version of Immich Server

V2.0.1

Version of Immich Mobile App

Platform with the issue

  • Server
  • Web
  • Mobile

Device make and model

Your docker-compose.yml content

name: immich

services:
  immich-server:
    container_name: immich_server
    image: ghcr.io/immich-app/immich-server:${IMMICH_VERSION:-release}
    volumes:
      - ${UPLOAD_LOCATION}:/data
      - /etc/localtime:/etc/localtime:ro
    devices:
      - /dev/dri:/dev/dri
    ports:
      - '2283:2283'
    depends_on:
      - redis
      - database
    restart: always
    healthcheck:
      disable: false

  immich-machine-learning:
    container_name: immich_machine_learning
    image: ghcr.io/immich-app/immich-machine-learning:${IMMICH_VERSION:-release}-openvino
    volumes:
      - model-cache:/cache
      - /dev/bus/usb:/dev/bus/usb
    device_cgroup_rules:
      - 'c 189:* rmw'
    devices:
      - /dev/dri:/dev/dri


    restart: always
    healthcheck:
      disable: false

  redis:
    container_name: immich_redis
    image: docker.io/valkey/valkey:8-bookworm@sha256:fea8b3e67b15729d4bb70589eb03367bab9ad1ee89c876f54327fc7c6e618571
    healthcheck:
      test: redis-cli ping || exit 1
    restart: always

  database:
    container_name: immich_postgres
    image: ghcr.io/immich-app/postgres:14-vectorchord0.4.3-pgvectors0.2.0@sha256:41eacbe83eca995561fe43814fd4891e16e39632806253848efaf04d3c8a8b84
    environment:
      POSTGRES_PASSWORD: ${DB_PASSWORD}
      POSTGRES_USER: ${DB_USERNAME}
      POSTGRES_DB: ${DB_DATABASE_NAME}
      POSTGRES_INITDB_ARGS: '--data-checksums'
    volumes:
      - ${DB_DATA_LOCATION}:/var/lib/postgresql/data
    shm_size: 128mb
    restart: always

volumes:
  model-cache:

Your .env content

UPLOAD_LOCATION=/mnt/nas_immich/immich
DB_DATA_LOCATION=/mnt/immich_db
IMMICH_VERSION=release
DB_PASSWORD=SSrtDiDIT3z9Tp
DB_USERNAME=postgres
DB_DATABASE_NAME=immich

#This is all unredacted, due to the nature of the bug.

Reproduction steps

  1. Stop Stack and remove all instances
  2. Clear/prune any unused volumes
  3. Clear images
  4. Clear contents of UPLOAD_LOCATION folder, as well as DB_DATA_LOCATION folder
  5. Create new stack normally, set DB password to something such as SSrtDiDIT3z9Tp

Relevant log output

immich_postgres:
2025-10-04 13:13:34.771 UTC [222] FATAL:  password authentication failed for user "postgres"
2025-10-04 13:13:34.771 UTC [222] DETAIL:  Connection matched pg_hba.conf line 100: "host all all all scram-sha-256"

immich_server:
microservices worker error: PostgresError: password authentication failed for user "postgres", stack: PostgresError: password authentication failed for user "postgres"
    at ErrorResponse (/usr/src/app/server/node_modules/.pnpm/postgres@3.4.7/node_modules/postgres/cjs/src/connection.js:794:26)
    at handle (/usr/src/app/server/node_modules/.pnpm/postgres@3.4.7/node_modules/postgres/cjs/src/connection.js:480:6)
    at Socket.data (/usr/src/app/server/node_modules/.pnpm/postgres@3.4.7/node_modules/postgres/cjs/src/connection.js:315:9)
    at Socket.emit (node:events:518:28)
    at addChunk (node:internal/streams/readable:561:12)
    at readableAddChunkPushByteMode (node:internal/streams/readable:512:3)
    at Readable.push (node:internal/streams/readable:392:5)
    at TCP.onStreamRead (node:internal/stream_base_commons:189:23)
microservices worker exited with code 1
Killing api process
Initializing Immich v2.0.1
Detected CPU Cores: 8

Additional information

To get the logs, I reproduced the bug on a completely new LXC. I should note though that simply changing the password afterwards to postgres doesn't fix it -- but removing everything (volumes, saved data, db) and starting it fresh with postgres as the database password seems to allow it to start without issue.

Starting a new stack with the password not as postgres seems to break things with my setup. Would be very curious to know if it's just my setup that causes this to happen.

Originally created by @ksparham on GitHub (Oct 4, 2025). ### I have searched the existing issues, both open and closed, to make sure this is not a duplicate report. - [x] Yes ### The bug So, I've been having an issue after restarting my stack on Portainer -- I kept getting a password error and after spending a few hours trying to figure out what on earth was wrong, I created a fresh stack and... same error. I regret not copying the errors, but they were postgre scram errors as well as invalid password errors. I'm running Immich docker via Portainer, inside a Proxmox LXC. Data is being saved to an iSCSI connection on NAS, database was being stored locally in the LXC. I acknowledge it may be a configuration/set up issue on my end, but it's odd how reliable I've been able to reproduce it. ### The OS that Immich Server is running on Ubuntu 22.04 LTS ### Version of Immich Server V2.0.1 ### Version of Immich Mobile App - ### Platform with the issue - [x] Server - [ ] Web - [ ] Mobile ### Device make and model - ### Your docker-compose.yml content ```YAML name: immich services: immich-server: container_name: immich_server image: ghcr.io/immich-app/immich-server:${IMMICH_VERSION:-release} volumes: - ${UPLOAD_LOCATION}:/data - /etc/localtime:/etc/localtime:ro devices: - /dev/dri:/dev/dri ports: - '2283:2283' depends_on: - redis - database restart: always healthcheck: disable: false immich-machine-learning: container_name: immich_machine_learning image: ghcr.io/immich-app/immich-machine-learning:${IMMICH_VERSION:-release}-openvino volumes: - model-cache:/cache - /dev/bus/usb:/dev/bus/usb device_cgroup_rules: - 'c 189:* rmw' devices: - /dev/dri:/dev/dri restart: always healthcheck: disable: false redis: container_name: immich_redis image: docker.io/valkey/valkey:8-bookworm@sha256:fea8b3e67b15729d4bb70589eb03367bab9ad1ee89c876f54327fc7c6e618571 healthcheck: test: redis-cli ping || exit 1 restart: always database: container_name: immich_postgres image: ghcr.io/immich-app/postgres:14-vectorchord0.4.3-pgvectors0.2.0@sha256:41eacbe83eca995561fe43814fd4891e16e39632806253848efaf04d3c8a8b84 environment: POSTGRES_PASSWORD: ${DB_PASSWORD} POSTGRES_USER: ${DB_USERNAME} POSTGRES_DB: ${DB_DATABASE_NAME} POSTGRES_INITDB_ARGS: '--data-checksums' volumes: - ${DB_DATA_LOCATION}:/var/lib/postgresql/data shm_size: 128mb restart: always volumes: model-cache: ``` ### Your .env content ```Shell UPLOAD_LOCATION=/mnt/nas_immich/immich DB_DATA_LOCATION=/mnt/immich_db IMMICH_VERSION=release DB_PASSWORD=SSrtDiDIT3z9Tp DB_USERNAME=postgres DB_DATABASE_NAME=immich #This is all unredacted, due to the nature of the bug. ``` ### Reproduction steps 1. Stop Stack and remove all instances 2. Clear/prune any unused volumes 3. Clear images 4. Clear contents of UPLOAD_LOCATION folder, as well as DB_DATA_LOCATION folder 5. Create new stack normally, set DB password to something such as SSrtDiDIT3z9Tp ### Relevant log output ```shell immich_postgres: 2025-10-04 13:13:34.771 UTC [222] FATAL: password authentication failed for user "postgres" 2025-10-04 13:13:34.771 UTC [222] DETAIL: Connection matched pg_hba.conf line 100: "host all all all scram-sha-256" immich_server: microservices worker error: PostgresError: password authentication failed for user "postgres", stack: PostgresError: password authentication failed for user "postgres" at ErrorResponse (/usr/src/app/server/node_modules/.pnpm/postgres@3.4.7/node_modules/postgres/cjs/src/connection.js:794:26) at handle (/usr/src/app/server/node_modules/.pnpm/postgres@3.4.7/node_modules/postgres/cjs/src/connection.js:480:6) at Socket.data (/usr/src/app/server/node_modules/.pnpm/postgres@3.4.7/node_modules/postgres/cjs/src/connection.js:315:9) at Socket.emit (node:events:518:28) at addChunk (node:internal/streams/readable:561:12) at readableAddChunkPushByteMode (node:internal/streams/readable:512:3) at Readable.push (node:internal/streams/readable:392:5) at TCP.onStreamRead (node:internal/stream_base_commons:189:23) microservices worker exited with code 1 Killing api process Initializing Immich v2.0.1 Detected CPU Cores: 8 ``` ### Additional information To get the logs, I reproduced the bug on a completely new LXC. I should note though that simply changing the password afterwards to postgres doesn't fix it -- but removing everything (volumes, saved data, db) and starting it fresh with postgres as the database password seems to allow it to start without issue. Starting a new stack with the password not as postgres seems to break things with my setup. Would be very curious to know if it's just my setup that causes this to happen.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
accessibility
changelog:enhancement
changelog:security
changelog:skip
changelog:translation
cli
date-time
dependencies
documentation
external-library
format
good first issue
mobile-beta
mobile-beta
mobile-beta
needs-answer
nice to have
pull-request
Mirrored from GitHub Pull Request
 sharing
tech-debt
📱mobile
🖥️web
🗄️server
🧠machine-learning
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
OVERLORD
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: immich-app/immich#7429
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?