From ef663c0c0814b7e80fb06586c79b55016f3c4bac Mon Sep 17 00:00:00 2001
From: hailin <hailin.zhao@gdzx.xyz>
Date: Sun, 1 Feb 2026 06:22:01 -0800
Subject: [PATCH] fix(deploy): replace envsubst with eval heredoc for
 ${VAR:-default} support

GNU envsubst does not handle ${VAR:-default} bash syntax - it leaves
the entire expression unsubstituted. This caused CDC connector
registration to fail with "password authentication failed for user
${POSTGRES_USER:-rwa_user}".

Replace all envsubst calls with a substitute_env_vars() helper that
uses eval+heredoc, which natively supports bash default value syntax.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---
 backend/services/deploy-mining.sh | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

diff --git a/backend/services/deploy-mining.sh b/backend/services/deploy-mining.sh
index b341781d..a562d35b 100755
--- a/backend/services/deploy-mining.sh
+++ b/backend/services/deploy-mining.sh
@@ -254,7 +254,6 @@ load_env() {
     fi
 
     # Set defaults (match docker-compose.yml settings)
-    # export is required so envsubst can access these when processing connector JSON templates
     export POSTGRES_HOST="${POSTGRES_HOST:-localhost}"
     export POSTGRES_PORT="${POSTGRES_PORT:-5432}"
     export POSTGRES_USER="${POSTGRES_USER:-rwa_user}"
@@ -268,6 +267,14 @@ load_env() {
     KAFKA_CONTAINER="${KAFKA_CONTAINER:-rwa-kafka}"
 }
 
+# Substitute environment variables in a file, supporting ${VAR:-default} syntax.
+# GNU envsubst does NOT handle ${VAR:-default}, so we use eval with heredoc instead.
+substitute_env_vars() {
+    eval "cat <<__ENVSUBST_EOF__
+$(cat "$1")
+__ENVSUBST_EOF__"
+}
+
 # ===========================================================================
 # Helper: Execute psql command (auto-detect Docker or local)
 # ===========================================================================
@@ -843,7 +850,7 @@ cdc_resnapshot() {
         if [ "$use_file_config" = true ]; then
             # Use config file, replace snapshot.mode with always
             local json_config
-            json_config=$(cat "$config_file" | envsubst | sed 's/"snapshot.mode": "initial"/"snapshot.mode": "always"/')
+            json_config=$(substitute_env_vars "$config_file" | sed 's/"snapshot.mode": "initial"/"snapshot.mode": "always"/')
             result=$(echo "$json_config" | curl -s -X POST "$connect_url/connectors" \
                 -H "Content-Type: application/json" \
                 -d @- 2>/dev/null)
@@ -944,9 +951,8 @@ register_outbox_connectors() {
             local config_only
             config_only=$(cat "$config_file" | sed 's/.*"config"://' | sed 's/}$//')
 
-            # Use envsubst to replace environment variables, then update
             local result
-            result=$(cat "$config_file" | envsubst | curl -s -X PUT \
+            result=$(substitute_env_vars "$config_file" | curl -s -X PUT \
                 -H "Content-Type: application/json" \
                 -d @- \
                 "$connect_url/connectors/$connector/config" 2>/dev/null)
@@ -960,7 +966,7 @@ register_outbox_connectors() {
             # Connector doesn't exist, create it
             # Replace environment variables in the config file
             local result
-            result=$(cat "$config_file" | envsubst | curl -s -X POST \
+            result=$(substitute_env_vars "$config_file" | curl -s -X POST \
                 -H "Content-Type: application/json" \
                 -d @- \
                 "$connect_url/connectors" 2>/dev/null)
@@ -1394,7 +1400,7 @@ full_reset() {
         if [ -n "$config_file" ] && [ -f "$config_file" ]; then
             log_info "Registering source connector: $connector"
             local result
-            result=$(cat "$config_file" | envsubst | curl -s -X POST "$DEBEZIUM_CONNECT_URL/connectors" \
+            result=$(substitute_env_vars "$config_file" | curl -s -X POST "$DEBEZIUM_CONNECT_URL/connectors" \
                 -H "Content-Type: application/json" \
                 -d @- 2>/dev/null)