fix: bind workspace connector configuration safely

docs/install/examples/connector-secrets.workspace-registry.yaml

@@ -0,0 +1,16 @@
+# Reviewed direct PostgreSQL/pgvector connector-secret override for workspace-bindings.env.example.
+# Source variables are absolute host paths. Add only matching entries for the selected transport;
+# targets must equal the corresponding THT_WS_*_FILE paths in the bindings env file.
+services:
+  core:
+    secrets:
+      - source: psd_clinical_dwh_password
+        target: psd-clinical-dwh-password
+      - source: psd_clinical_vector_password
+        target: psd-clinical-vector-password
+
+secrets:
+  psd_clinical_dwh_password:
+    file: ${THT_WS_PSD_CLINICAL_DWH_PASSWORD_SOURCE:?set THT_WS_PSD_CLINICAL_DWH_PASSWORD_SOURCE}
+  psd_clinical_vector_password:
+    file: ${THT_WS_PSD_CLINICAL_VECTOR_PASSWORD_SOURCE:?set THT_WS_PSD_CLINICAL_VECTOR_PASSWORD_SOURCE}

docs/install/examples/local-compose.workspace-registry.yaml

@@ -8,6 +8,9 @@ services:
     build:
       context: ${THT_SOURCE_ROOT:?set THT_SOURCE_ROOT to the absolute ThothII source checkout}
       dockerfile: docker/core.Dockerfile
+    env_file:
+      - path: ${THT_WORKSPACE_BINDINGS_ENV_FILE:?set THT_WORKSPACE_BINDINGS_ENV_FILE to an absolute THT_WS bindings file}
+        required: true
     environment:
       HOST: 0.0.0.0
       PORT: "8787"

docs/install/examples/server-compose.workspace-registry.yaml

@@ -8,6 +8,9 @@ services:
     build:
       context: ${THT_SOURCE_ROOT:?set THT_SOURCE_ROOT to the absolute ThothII source checkout}
       dockerfile: docker/core.Dockerfile
+    env_file:
+      - path: ${THT_WORKSPACE_BINDINGS_ENV_FILE:?set THT_WORKSPACE_BINDINGS_ENV_FILE to an absolute THT_WS bindings file}
+        required: true
     environment:
       HOST: 0.0.0.0
       PORT: "8787"

docs/install/examples/workspace-bindings.env.example

@@ -0,0 +1,13 @@
+# Copy to an untracked operator file. This file contains only non-secret THT_WS_* bindings.
+# Every *_FILE value is a container path supplied by a reviewed connector-secret override.
+THT_WS_PSD_CLINICAL_DWH_TRANSPORT=postgres_direct
+THT_WS_PSD_CLINICAL_DWH_HOST=dwh.internal.example
+THT_WS_PSD_CLINICAL_DWH_PORT=5432
+THT_WS_PSD_CLINICAL_DWH_USER=thoth_reader
+THT_WS_PSD_CLINICAL_DWH_PASSWORD_FILE=/run/secrets/psd-clinical-dwh-password
+THT_WS_PSD_CLINICAL_VECTOR_TRANSPORT=pgvector_direct
+THT_WS_PSD_CLINICAL_VECTOR_HOST=vector.internal.example
+THT_WS_PSD_CLINICAL_VECTOR_PORT=5432
+THT_WS_PSD_CLINICAL_VECTOR_USER=thoth_vector_reader
+THT_WS_PSD_CLINICAL_VECTOR_PASSWORD_FILE=/run/secrets/psd-clinical-vector-password
+THT_WS_PSD_CLINICAL_EMBEDDING_BASE_URL=https://embeddings.internal.example