I’m trying to run these containers because there’s no nixos module, and I’ve got the following setup, generated by compose2nix:
sops.secrets = {
"docmost/db" = { };
"docmost/secret" = { };
};
sops.templates."docmost-db-url".content = "DATABASE_URL=postgresql://docmost:${config.sops.placeholder."docmost/db"}@db:5432/docmost";
sops.templates."docmost-db-env".content = "POSTGRES_PASSWORD=${config.sops.placeholder."docmost/db"}";
## Docmost
# Runtime
virtualisation.podman = {
enable = true;
autoPrune.enable = true;
dockerCompat = true;
};
virtualisation.oci-containers.backend = "podman";
# Containers
virtualisation.oci-containers.containers."docmost-db" = {
image = "postgres:18";
environment = {
"POSTGRES_DB" = "docmost";
"POSTGRES_USER" = "docmost";
};
environmentFiles = [ config.sops.templates."docmost-db-env".path ];
volumes = [
"docmost_db_data:/var/lib/postgresql:rw"
];
log-driver = "journald";
extraOptions = [
"--network-alias=db"
"--network=docmost_default"
];
};
systemd.services."podman-docmost-db" = {
serviceConfig = {
Restart = lib.mkOverride 90 "always";
};
after = [
"podman-network-docmost_default.service"
"podman-volume-docmost_db_data.service"
];
requires = [
"podman-network-docmost_default.service"
"podman-volume-docmost_db_data.service"
];
partOf = [
"podman-compose-docmost-root.target"
];
wantedBy = [
"podman-compose-docmost-root.target"
];
};
virtualisation.oci-containers.containers."docmost-docmost" = {
image = "docmost/docmost:latest";
environment = {
"APP_URL" = "https://note.vikezor.click";
"REDIS_URL" = "redis://redis:6379";
};
environmentFiles = [
config.sops.secrets."docmost/secret".path
config.sops.templates."docmost-db-url".path
];
volumes = [
"docmost_docmost:/app/data/storage:rw"
];
ports = [
"3000:3000/tcp"
];
dependsOn = [
"docmost-db"
"docmost-redis"
];
log-driver = "journald";
extraOptions = [
"--network-alias=docmost"
"--network=docmost_default"
];
};
systemd.services."podman-docmost-docmost" = {
serviceConfig = {
Restart = lib.mkOverride 90 "always";
};
after = [
"podman-network-docmost_default.service"
"podman-volume-docmost_docmost.service"
];
requires = [
"podman-network-docmost_default.service"
"podman-volume-docmost_docmost.service"
];
partOf = [
"podman-compose-docmost-root.target"
];
wantedBy = [
"podman-compose-docmost-root.target"
];
};
virtualisation.oci-containers.containers."docmost-redis" = {
image = "redis:8";
volumes = [
"docmost_redis_data:/data:rw"
];
cmd = [ "redis-server" "--appendonly" "yes" "--maxmemory-policy" "noeviction" ];
log-driver = "journald";
extraOptions = [
"--network-alias=redis"
"--network=docmost_default"
];
};
systemd.services."podman-docmost-redis" = {
serviceConfig = {
Restart = lib.mkOverride 90 "always";
};
after = [
"podman-network-docmost_default.service"
"podman-volume-docmost_redis_data.service"
];
requires = [
"podman-network-docmost_default.service"
"podman-volume-docmost_redis_data.service"
];
partOf = [
"podman-compose-docmost-root.target"
];
wantedBy = [
"podman-compose-docmost-root.target"
];
};
# Networks
systemd.services."podman-network-docmost_default" = {
path = [ pkgs.podman ];
serviceConfig = {
Type = "oneshot";
RemainAfterExit = true;
ExecStop = "podman network rm -f docmost_default";
};
script = ''
podman network inspect docmost_default || podman network create docmost_default
'';
partOf = [ "podman-compose-docmost-root.target" ];
wantedBy = [ "podman-compose-docmost-root.target" ];
};
# Volumes
systemd.services."podman-volume-docmost_db_data" = {
path = [ pkgs.podman ];
serviceConfig = {
Type = "oneshot";
RemainAfterExit = true;
};
script = ''
podman volume inspect docmost_db_data || podman volume create docmost_db_data
'';
partOf = [ "podman-compose-docmost-root.target" ];
wantedBy = [ "podman-compose-docmost-root.target" ];
};
systemd.services."podman-volume-docmost_docmost" = {
path = [ pkgs.podman ];
serviceConfig = {
Type = "oneshot";
RemainAfterExit = true;
};
script = ''
podman volume inspect docmost_docmost || podman volume create docmost_docmost
'';
partOf = [ "podman-compose-docmost-root.target" ];
wantedBy = [ "podman-compose-docmost-root.target" ];
};
systemd.services."podman-volume-docmost_redis_data" = {
path = [ pkgs.podman ];
serviceConfig = {
Type = "oneshot";
RemainAfterExit = true;
};
script = ''
podman volume inspect docmost_redis_data || podman volume create docmost_redis_data
'';
partOf = [ "podman-compose-docmost-root.target" ];
wantedBy = [ "podman-compose-docmost-root.target" ];
};
# Root service
# When started, this will automatically create all resources and start
# the containers. When stopped, this will teardown all resources.
systemd.targets."podman-compose-docmost-root" = {
unitConfig = {
Description = "Root target generated by compose2nix.";
};
wantedBy = [ "multi-user.target" ];
};
As far as I can tell, the password for the postgres user and the password docmost tries to connect with are the same, yet,
Jul 10 14:16:19 medium docmost-docmost[2242047]: {"level":"error","time":"2026-07-10T11:16:19.469Z","pid":40,"hostname":"e2966319f721","context":"DatabaseModule","err":{"type":"PostgresError","message":"password authentication failed for user \"docmost\"","stack":"PostgresError: password authentication failed for user \"docmost\"\n at ErrorResponse (/app/node_modules/.pnpm/postgres@3.4.8/node_modules/postgres/cjs/src/connection.js:817:22)\n at handle (/app/node_modules/.pnpm/postgres@3.4.8/node_modules/postgres/cjs/src/connection.js:489:6)\n at Socket.data (/app/node_modules/.pnpm/postgres@3.4.8/node_modules/postgres/cjs/src/connection.js:324:9)\n at Socket.emit (node:events:519:28)\n at addChunk (node:internal/streams/readable:561:12)\n at readableAddChunkPushByteMode (node:internal/streams/readable:512:3)\n at Readable.push (node:internal/streams/readable:392:5)\n at TCP.onStreamRead (node:internal/stream_base_commons:189:23)","name":"PostgresError","severity_local":"FATAL","severity":"FATAL","code":"28P01","file":"auth.c","line":"317","routine":"auth_failed"},"msg":"password authentication failed for user \"docmost\""}
Jul 10 14:16:19 medium docmost-docmost[2242047]: {"level":"info","time":"2026-07-10T11:16:19.469Z","pid":40,"hostname":"e2966319f721","context":"DatabaseModule","msg":"Retrying [3/15] in 3 seconds"}
Jul 10 14:16:19 medium docmost-db[2232225]: 2026-07-10 11:16:19.486 UTC [320] FATAL: password authentication failed for user "docmost"
Jul 10 14:16:19 medium docmost-db[2232225]: 2026-07-10 11:16:19.486 UTC [320] DETAIL: Connection matched file "/var/lib/postgresql/18/docker/pg_hba.conf" line 128: "host all all all scram-sha-256"
I tried just writing the password in the configuration directly instead of using sops, and the result was the same. what’s going on here please thanks