Configure the database service

The official PostgreSQL image needs initial database credentials. The API needs a connection URL using the Compose service name.

Environment variables configure a container at runtime. Keep real secrets out of the Compose file committed to Git; use a local ignored environment file or a platform secret store for deployments.

services:
  api:
    environment:
      DATABASE_URL: postgres://notes:development-only@database:5432/notes
  database:
    environment:
      POSTGRES_USER: notes
      POSTGRES_PASSWORD: development-only
      POSTGRES_DB: notes

Initialization variables affect the official image only when the database directory is empty. Once a named volume contains a database, changing POSTGRES_USER, POSTGRES_PASSWORD, or POSTGRES_DB does not rewrite existing roles and data. Make later changes through database administration or migrations and test them against a copy of real data.

A connection URL is convenient but easy to expose in logs or process inspection. Keep production credentials in a platform secret store, give the application only the permissions it needs, and rotate credentials independently of rebuilding the image. Development defaults must be obviously local and must never become the production fallback.

Add development configuration, start only the database, and inspect its logs with docker compose logs database.