feat: read managed database passwords from secrets

internal/postgres/provisioner_integration_test.go

@@ -5,20 +5,26 @@ package postgres
 import (
 	"context"
 	"net"
+	"os"
+	"path/filepath"
 	"testing"
 	"time"
 
-	config "cloud.campbellwireless.net/git/barkstack/barkfile-parser"
+	config "cloud.campbellwireless.net/git/barkstack/barkfile-parser/v2"
 )
 
 func TestProvisionerCreatesPersistentPostgres18(t *testing.T) {
 	const (
-		database = "pawsql_integration_test"
-		volume   = "pawsql-integration-test-data"
-		envName  = "PAWSQL_INTEGRATION_POSTGRES_PASSWORD"
+		database  = "pawsql_integration_test"
+		volume    = "pawsql-integration-test-data"
+		secretRef = "integration_postgres_password"
 	)
-	t.Setenv(envName, "integration-test-password")
+	secretDirectory := t.TempDir()
+	if err := os.WriteFile(filepath.Join(secretDirectory, config.DockerSecretName(secretRef)), []byte("integration-test-password"), 0o600); err != nil {
+		t.Fatal(err)
+	}
 	provisioner := NewProvisioner(nil)
+	provisioner.SecretDirectory = secretDirectory
 	defer func() {
 		_, _ = provisioner.run(context.Background(), nil, "container", "rm", "--force", containerName(database))
 		_, _ = provisioner.run(context.Background(), nil, "volume", "rm", "--force", volume)
@@ -27,9 +33,9 @@ func TestProvisionerCreatesPersistentPostgres18(t *testing.T) {
 	cfg := config.Config{Databases: []config.DatabaseConfig{{
 		Name: database,
 		Postgres: &config.PostgresConfig{
-			Image:       "postgres:18",
-			Volume:      volume,
-			PasswordEnv: envName,
+			Image:          "postgres:18",
+			Volume:         volume,
+			PasswordSecret: secretRef,
 		},
 	}}}
 	resolved, err := provisioner.Ensure(context.Background(), cfg)