a month ago
Hello,
I need to rotate a compromised PostgreSQL credential in a production Postgres HA cluster.
Database → Config → Regenerate Password fails with:
“Failed to regenerate password — Password reset is not supported for Postgres HA clusters.”
The failed attempt did not change variables or deployments. The database and dependent application remain healthy.
The application consumes Postgres.DATABASE_URL through a Railway reference variable. I have not manually edited POSTGRES_PASSWORD, PGPASSWORD, DATABASE_URL or DATABASE_PUBLIC_URL, changed the HA topology, or executed ALTER ROLE.
What is the officially supported procedure for rotating credentials on a Railway Postgres HA cluster while keeping the PostgreSQL role password and all generated connection variables synchronized?
Please also clarify which database components and dependent services must be redeployed, expected downtime, verification without revealing values, and the supported rollback procedure.
No secret values, connection strings, deployment IDs, personal data or financial data are included.
Thank you.
3 Replies
Status changed to Awaiting Railway Response Railway • 27 days ago
a month ago
This thread has been opened as a bounty so the community can help solve it.
Status changed to Open Railway • 27 days ago
a month ago
You can try to do it manually, by selecting the HA node, then go to the console tab , from there you can run psql, then use the command ALTER ROLE postgres WITH PASSWORD '<PASSWORD>';. Use the password to update the POSTGRES_PASSWORD/PGPASSWORD variable on the original postgres node you created the HA cluster from . Then redeploy all related services (including all Postgres nodes and the HA instance).
a month ago
Thank you. Before proceeding, could Railway confirm this exact point for the linked production Postgres HA service?
After changing the PostgreSQL role password manually and updating only POSTGRES_PASSWORD on the original Postgres node, will Railway automatically recompute and synchronize all of these variables?
- PGPASSWORD
- DATABASE_URL
- DATABASE_PUBLIC_URL
The application already consumes Postgres.DATABASE_URL through a Railway reference variable.
We will not inspect unrendered values, manually edit derived URLs, or execute the rotation until this synchronization behavior is explicitly confirmed.
Could you also confirm whether the required redeploy order remains:
primary → replicas one at a time → HAProxy → dependent application?
No secret values are included.
a month ago
Updating POSTGRES_PASSWORD will automatically update PGPASSWORD as well because it is referenced to POSTGRES_PASSWORD, the same happen for DATABASE_URL and DATABASE_PUBLIC_URL
As darseen said, you will need to redeploy service that uses ${{Postgres.DATABASE_URL}} to take effect of the changes