From 05c83cacc1793243ae49cbe0ef1cf25860e1784f Mon Sep 17 00:00:00 2001
From: Lasse Benninga <devops.pipeline@example.com>
Date: Wed, 8 Jul 2026 12:23:48 +0200
Subject: [PATCH] fix(week10): require SSL for Azure Postgres + add
 .env.example

- profiles.yml.example: add sslmode: require (Azure Database for
  PostgreSQL needs an encrypted connection).
- add .env.example with PG_* exports so students copy to .env, fill in
  the password, and source it instead of retyping exports.
- README Task 1: switch from ad-hoc exports to the cp .env.example .env
  + source .env flow.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .env.example         | 12 ++++++++++++
 README.md            | 12 +++++++-----
 profiles.yml.example |  2 ++
 3 files changed, 21 insertions(+), 5 deletions(-)
 create mode 100644 .env.example

diff --git a/.env.example b/.env.example
new file mode 100644
index 0000000..30658e3
--- /dev/null
+++ b/.env.example
@@ -0,0 +1,12 @@
+# Connection settings for the shared Azure PostgreSQL database.
+#
+# 1. Copy this file to .env:            cp .env.example .env
+# 2. Fill in the real values below (the class vault has them; ask your mentor if any are missing).
+# 3. Load them into your shell before running dbt:   source .env
+#
+# .env is git-ignored — never commit it with a real password.
+
+export PG_HOST=<your-server>.postgres.database.azure.com
+export PG_USER=<your_login>
+export PG_PASSWORD=<your_password>
+export PG_DBNAME=postgres
diff --git a/README.md b/README.md
index a18f257..2f6f389 100644
--- a/README.md
+++ b/README.md
@@ -15,6 +15,7 @@ This repo is a **ready-to-run dbt project**: the project config is wired up and
 ├── dbt_project.yml              <- ready to run: staging = view, marts = table
 ├── packages.yml                 <- TODO stub: declare dbt_utils (Task 5)
 ├── profiles.yml.example         <- connection template: copy to profiles.yml
+├── .env.example                 <- env var template: copy to .env, fill in, then source it
 ├── macros/
 │   └── safe_divide.sql          <- TODO stub: implement the macro
 ├── models/
@@ -46,15 +47,16 @@ cp profiles.yml.example profiles.yml
 # edit profiles.yml: replace <your_name> so schema reads dev_<your_name>
 ```
 
-2. Export the connection env vars (values are in the class vault; ask your mentor if you are missing them):
+2. Set the connection env vars (values are in the class vault; ask your mentor if you are missing them). Copy the template, fill in the real values, and load them into your shell:
 
 ```bash
-export PG_HOST=...
-export PG_USER=...
-export PG_PASSWORD=...
-export PG_DBNAME=postgres
+cp .env.example .env
+# edit .env: fill in PG_HOST, PG_USER, PG_PASSWORD (PG_DBNAME stays postgres)
+source .env
 ```
 
+`.env` is git-ignored, so your password stays out of Git. Run `source .env` again in any new terminal before running dbt.
+
 3. Verify: `dbt debug` must end with `All checks passed!`.
 
 `profiles.yml` is git-ignored. Never commit it: the autograder treats a committed `profiles.yml` as a blocker.
diff --git a/profiles.yml.example b/profiles.yml.example
index 82c6ae0..c04ec56 100644
--- a/profiles.yml.example
+++ b/profiles.yml.example
@@ -9,8 +9,10 @@ nyc_taxi_borough_daily:
       password: "{{ env_var('PG_PASSWORD') }}"
       dbname: "{{ env_var('PG_DBNAME', 'postgres') }}"
       schema: "dev_<your_name>"   # TODO: replace <your_name> with your first name (the schema you already own)
+      sslmode: require            # Azure Database for PostgreSQL requires an encrypted connection
       threads: 1
 
 # Copy this file to profiles.yml (same directory), fill in your name, and ensure
 # PG_HOST, PG_USER, PG_PASSWORD, and PG_DBNAME are set in your environment.
+# The quickest way to set them: cp .env.example .env, fill in .env, then run: source .env
 # profiles.yml is git-ignored — never commit it with a real password.