vault app_role secrets pass

ci/prod/compose/db.yml

@@ -15,7 +15,7 @@ volumes:
       type: tmpfs
       device: tmpfs
       o: size=32m,uid=999,gid=999,mode=0750
-  # In-memory config for PBM (renders from templates, no host persistence)
+  # In-memory config for PBM (rendered from templates, no host persistence)
   pbm_cfg:
     driver: local
     driver_opts:
@@ -30,22 +30,24 @@ services:
     container_name: vault-agent-sendico
     restart: unless-stopped
     cap_add: ["IPC_LOCK"]
-    # Only static env here. AppRole creds are injected via CI at runtime.
+    # VAULT_ADDR is required by the agent and comes from ../env/.env.runtime
+    # VAULT_ROLE_ID / VAULT_SECRET_ID are passed only during `docker compose` from CI
     environment:
       VAULT_ADDR: ${VAULT_ADDR}
-      VAULT_ROLE_ID: ${VAULT_ROLE_ID}       # provided only during `docker compose up`
-      VAULT_SECRET_ID: ${VAULT_SECRET_ID}   # provided only during `docker compose up`
+      VAULT_ROLE_ID: ${VAULT_ROLE_ID}
+      VAULT_SECRET_ID: ${VAULT_SECRET_ID}
     volumes:
       - ./vault/agent.hcl:/etc/vault/agent.hcl:ro
       - ./vault/templates:/etc/vault/templates:ro
       - vault_secrets:/vault/secrets:rw
       - pbm_cfg:/etc/backup:rw
-    # Write AppRole creds to tmpfs, drop them from env, then exec agent
+    # Write AppRole creds into tmpfs, unset them from env, then exec the agent
+    # Note: use $${...} here to avoid compose-time interpolation
     command: >
       sh -lc 'set -euo pipefail; umask 077;
-              : "${VAULT_ROLE_ID:?}"; : "${VAULT_SECRET_ID:?}";
-              printf "%s" "$VAULT_ROLE_ID"   > /vault/secrets/role_id;
-              printf "%s" "$VAULT_SECRET_ID" > /vault/secrets/secret_id;
+              : "$${VAULT_ADDR:?}"; : "$${VAULT_ROLE_ID:?}"; : "$${VAULT_SECRET_ID:?}";
+              printf "%s" "$${VAULT_ROLE_ID}"   > /vault/secrets/role_id;
+              printf "%s" "$${VAULT_SECRET_ID}" > /vault/secrets/secret_id;
               unset VAULT_ROLE_ID VAULT_SECRET_ID;
               exec vault agent -config=/etc/vault/agent.hcl'
     healthcheck:
@@ -60,7 +62,9 @@ services:
     image: docker.io/library/mongo:latest
     container_name: sendico_db1
     restart: unless-stopped
-    depends_on: { vault-agent-sendico: { condition: service_healthy } }
+    depends_on:
+      vault-agent-sendico:
+        condition: service_healthy
     entrypoint: ["/usr/local/bin/mongo-entrypoint-wrapper.sh"]
     command: >
       mongod --replSet ${MONGO_REPLICA_SET} --bind_ip_all --auth
@@ -82,7 +86,9 @@ services:
     image: docker.io/library/mongo:latest
     container_name: sendico_db2
     restart: unless-stopped
-    depends_on: { vault-agent-sendico: { condition: service_healthy } }
+    depends_on:
+      vault-agent-sendico:
+        condition: service_healthy
     entrypoint: ["/usr/local/bin/mongo-entrypoint-wrapper.sh"]
     command: >
       mongod --replSet ${MONGO_REPLICA_SET} --bind_ip_all --auth
@@ -103,7 +109,9 @@ services:
     image: docker.io/library/mongo:latest
     container_name: sendico_db3
     restart: unless-stopped
-    depends_on: { vault-agent-sendico: { condition: service_healthy } }
+    depends_on:
+      vault-agent-sendico:
+        condition: service_healthy
     entrypoint: ["/usr/local/bin/mongo-entrypoint-wrapper.sh"]
     command: >
       mongod --replSet ${MONGO_REPLICA_SET} --bind_ip_all --auth