# New knowledge base

## 2026-04 — Postgres `POSTGRES_PASSWORD` vs existing volume

- Service roles (`supabase_auth_admin`, `authenticator`, `supabase_storage_admin`, …) get their passwords at **first** `db` init (see `volumes/db/roles.sql`). If `POSTGRES_PASSWORD` in `.env` later **differs** from what was used at init, containers still read the new value from env but Postgres still has the old passwords → `FATAL: password authentication failed` / SQLSTATE `28P01`.
- **`npm run sync:db-passwords`** runs `ALTER ROLE … WITH PASSWORD` for the standard roles to match `.env`. Rebuild/restart auth and other Supabase services after.

## 2026-04 — Docker host ports (multi-stack)

- Published ports in `docker-compose.yml` use `.env` variables: `STUDIO_HOST_PORT`, `KONG_HTTP_HOST_PORT`, `KONG_HTTPS_HOST_PORT`, `API_HOST_PORT`, `POSTGRES_HOST_PORT`, `POOLER_HOST_PORT`, `ANALYTICS_HOST_PORT`, plus `FRONTEND_PORT`.
- **`PUBLIC_SITE_HOST`** (default `localhost`) plus `_*_HOST_PORT` drives browser-facing URLs in compose: `VITE_*`, `SUPABASE_PUBLIC_URL`, `API_EXTERNAL_URL`, `SITE_URL`/`FRONTEND_URL`, and API `CORS_ORIGIN`—override full URLs only for https or proxies.

## 2026-04 — Login signup chat

- **Public signup** uses `signup_sessions` (state machine over `POST /api/v1/signup/chat`), SHA-256–hashed verification tokens, and `POST /api/v1/signup/complete` to create `company_user` rows after the user sets a password.
- **`companies.account_code`** is a stable customer-facing join key (backfilled from existing `id`); new companies get a random `C` + hex code from `companyService.upsertByName` insert path.
- **`FRONTEND_URL`** on the API builds verification links; compose defaults to `http://PUBLIC_SITE_HOST:FRONTEND_PORT` unless overridden.