From dfb18f75e6bbb5c6d0fc10ac3af67c51bdc19a23 Mon Sep 17 00:00:00 2001
From: "Rodrigo Rodriguez (Pragmatismo)" <me@rodrigorodriguez.com>
Date: Thu, 5 Feb 2026 14:42:13 -0300
Subject: [PATCH] Fix bootstrap database creation - use BOOTSTRAP_DB_PASSWORD
 env var

---
 src/core/bootstrap/mod.rs          |  6 +++++-
 src/core/package_manager/facade.rs | 26 ++++++++++++++++++--------
 2 files changed, 23 insertions(+), 9 deletions(-)

diff --git a/src/core/bootstrap/mod.rs b/src/core/bootstrap/mod.rs
index 87d5ef46d..8fff6a8bd 100644
--- a/src/core/bootstrap/mod.rs
+++ b/src/core/bootstrap/mod.rs
@@ -921,16 +921,20 @@ impl BootstrapManager {
 
                 if component == "tables" {
                     info!("Starting PostgreSQL database...");
+                    
+                    std::env::set_var("BOOTSTRAP_DB_PASSWORD", &db_password);
+                    
                     match pm.start("tables") {
                         Ok(_) => {
                             info!("PostgreSQL started successfully");
-
                             tokio::time::sleep(tokio::time::Duration::from_secs(3)).await;
                         }
                         Err(e) => {
                             warn!("Failed to start PostgreSQL: {}", e);
                         }
                     }
+                    
+                    std::env::remove_var("BOOTSTRAP_DB_PASSWORD");
 
                     info!("Running database migrations...");
                     let database_url =
diff --git a/src/core/package_manager/facade.rs b/src/core/package_manager/facade.rs
index 1eadbd601..a16417c3d 100644
--- a/src/core/package_manager/facade.rs
+++ b/src/core/package_manager/facade.rs
@@ -1047,6 +1047,10 @@ Store credentials in Vault:
         Ok(())
     }
     pub fn run_commands(&self, commands: &[String], target: &str, component: &str) -> Result<()> {
+        self.run_commands_with_password(commands, target, component, &String::new())
+    }
+
+    pub fn run_commands_with_password(&self, commands: &[String], target: &str, component: &str, db_password_override: &str) -> Result<()> {
         let bin_path = if target == "local" {
             self.base_path.join("bin").join(component)
         } else {
@@ -1069,14 +1073,20 @@ Store credentials in Vault:
             PathBuf::from("/opt/gbo/logs")
         };
 
-        let db_password = match get_database_url_sync() {
-            Ok(url) => {
-                let (_, password, _, _, _) = parse_database_url(&url);
-                password
-            }
-            Err(_) => {
-                trace!("Vault not available for DB_PASSWORD, using empty string");
-                String::new()
+        let db_password = if let Ok(env_pwd) = std::env::var("BOOTSTRAP_DB_PASSWORD") {
+            env_pwd
+        } else if !db_password_override.is_empty() {
+            db_password_override.clone()
+        } else {
+            match get_database_url_sync() {
+                Ok(url) => {
+                    let (_, password, _, _, _) = parse_database_url(&url);
+                    password
+                }
+                Err(_) => {
+                    trace!("Vault not available for DB_PASSWORD, using empty string");
+                    String::new()
+                }
             }
         };