Clojurians Log v2
Clojure programming
Channels
Apps
datomic 2026-08-22
When using Postgres storage, the Datomic DB URI may include sensitive credentials (a username and password).
For a peer, it's straightforward to have your app use some kind of secret-discovery mechanism to retrieve these, but the transactor start script only supports configuring the DB URI via Java properties--which means these credentials must be on the machine in cleartext, either on disk in a .properties file or passed via command-line (which means they appear in cleartext in the process table).
Is there a standard workaround for this issue?
Its not a complete solution, but I do recommend using the properties file as that will avoid the ps/process table and is better from an exposure standpoint than command line args. Then lock down the file with chmod 600 and deploy any filesystem protection you can find. That all being said, we could use a feature in this area to give you a better option here. I will log a story for us to consider features to hide these credentials.
favila 2026-08-24T14:32:49.479239Z
you could also create your own SQL driver class that does auth via whatever secure channel you want and supply it to datomic
favila 2026-08-24T14:33:48.125569Z
e.g. a wrapper around org.postgresql.Driver