5 hours ago
Hello! I run an app on Railway with a Postgres service (the Railway Postgres template). As a security precaution I want to rotate the database password.
Right now my app connects through DATABASE_URL, which references the Postgres service variables (POSTGRES_PASSWORD / PGPASSWORD).
My questions:
If I just change POSTGRES_PASSWORD in the variables tab, does it actually change the password of the existing database, or only the variable (since the data volume is already initialized)?
What is the recommended safe procedure so my app does not lose the connection? (for example: ALTER USER … PASSWORD …, then update the variables, then redeploy)
Does the app need a redeploy after the change, and in what order should I do things?
The database has no public TCP proxy, it is only used through the private network. Thanks!
2 Replies
5 hours ago
Editing POSTGRES_PASSWORD in the variables tab only changes the variable. The database volume is already initialized, so the password inside Postgres stays the same and your app's connection string stops matching it. Running ALTER USER by hand has the same problem in reverse. Either change on its own leaves the database and its variables out of sync, so we recommend neither.
The supported way to do this is the Regenerate option. Open the Postgres service, go to Database > Config > Connection, and click Regenerate. We change the password inside Postgres, update the service variables, and redeploy the database. Then we automatically redeploy any running services in the same environment that use the password through Railway variable references.
Your app uses DATABASE_URL as a reference to the Postgres variables, so it picks up the new password on that automatic redeploy, and you don't need to redeploy it or do anything in a particular order. Expect a short interruption while the database restarts. Services that use a pasted connection string, services in other projects, and clients outside Railway still need the new value entered by hand. More details are in the database view docs.
Status changed to Awaiting User Response Railway • about 5 hours ago
3 hours ago
Help me fix
Status changed to Awaiting Railway Response Railway • about 3 hours ago
Status changed to Awaiting User Response Railway • about 3 hours ago