Failed to connect to the database: SASL authentication failed

[deefdragon]

Some or all of the below information will be requested if it isn’t supplied; for fastest response please provide as much as you can.

The Basics

• Nextcloud Server version (e.g., 29.x.x):
  • docker tag nextcloud:29.0.0-apache
• Operating system and version (e.g., Ubuntu 24.04):
  • k8s 1.31
• Web server and version (e.g, Apache 2.4.25):
  • whatever is in nextcloud:29.0.0-apache
• Reverse proxy and version _(e.g. nginx 1.27.2)
  • traefik into nginx k8s ingress
• PHP version (e.g, 8.3):
  • whatever is in nextcloud:29.0.0-apache
• Is this the first time you’ve seen this error? (Yes / No):
  • yes
• When did this problem seem to first start?
  • After I rotated my postgres password for nextcloud
• Installation method (e.g. AlO, NCP, Bare Metal/Archive, etc.)
  • helm chart on k8s
• Are you using CloudfIare, mod_security, or similar? (Yes / No)
  • yes

Summary of the issue you are facing:

I recently had to rotate the password for the postgres account used by my nextcloud instance. After updating the password, and restarting the nextcloud server, the server is failing to properly start up, and the status.php checks are 500-ing.

Running any php occ commands in the container result in this error being thrown

Failed to connect to the database: An exception occurred in the driver: SQLSTATE[08006] [7] connection to server at "<server hostname>" (<server IP>), port 5432 failed: FATAL: SASL authentication failed in /var/www/html/lib/private/DB/Connection.php:155

(full stack is below nextcloud configuration)

Steps to replicate it (hint: details matter!):

1. Rotate password in postgres
2. Restart Nextcloud

Log entries

Nextcloud

<IP> - - [08/Sep/2025:02:07:51 +0000] "GET /status.php HTTP/1.1" 500 410 "-" "kube-probe/1.31"
...Repeated for each check...

Configuration

Nextcloud

The output of occ config:list system or similar is best, but, if not possible, the contents of your config.php file from /path/to/nextcloud is fine (make sure to remove any identifiable information!):

# php occ config:list system
An unhandled exception has been thrown:
Doctrine\DBAL\Exception: Failed to connect to the database: An exception occurred in the driver: SQLSTATE[08006] [7] connection to server at "<server hostname>" (<server IP>), port 5432 failed: FATAL:  SASL authentication failed in /var/www/html/lib/private/DB/Connection.php:155
Stack trace:
#0 /var/www/html/3rdparty/doctrine/dbal/src/Connection.php(453): OC\DB\Connection->connect()
#1 /var/www/html/3rdparty/doctrine/dbal/src/Connection.php(411): Doctrine\DBAL\Connection->getDatabasePlatformVersion()
#2 /var/www/html/3rdparty/doctrine/dbal/src/Connection.php(318): Doctrine\DBAL\Connection->detectDatabasePlatform()
#3 /var/www/html/lib/private/DB/ConnectionAdapter.php(200): Doctrine\DBAL\Connection->getDatabasePlatform()
#4 /var/www/html/lib/private/DB/QueryBuilder/QueryBuilder.php(121): OC\DB\ConnectionAdapter->getDatabasePlatform()
#5 /var/www/html/lib/private/AppConfig.php(1237): OC\DB\QueryBuilder\QueryBuilder->expr()
#6 /var/www/html/lib/private/AppConfig.php(262): OC\AppConfig->loadConfig(false)
#7 /var/www/html/lib/private/AppConfig.php(1378): OC\AppConfig->searchValues('enabled')
#8 /var/www/html/lib/private/App/AppManager.php(131): OC\AppConfig->getValues(false, 'enabled')
#9 /var/www/html/lib/private/App/AppManager.php(152): OC\App\AppManager->getInstalledAppsValues()
#10 /var/www/html/lib/private/legacy/OC_App.php(234): OC\App\AppManager->getInstalledApps()
#11 /var/www/html/lib/private/AppFramework/Bootstrap/Coordinator.php(90): OC_App::getEnabledApps()
#12 /var/www/html/lib/base.php(706): OC\AppFramework\Bootstrap\Coordinator->runInitialRegistration()
#13 /var/www/html/lib/base.php(1181): OC::init()
#14 /var/www/html/console.php(48): require_once('/var/www/html/l...')
#15 /var/www/html/occ(11): require_once('/var/www/html/c...')
#16 {main}root@nextcloud-7bf56fdc4c-4kf9f:/var/www/html

Apps

The output of occ app:list (if possible).

same error as above

[deefdragon]

I figured out a way to atleast get things working again.

Changing the password in the secret changes the environment variable. This env-var is only used however, in autoconfig.php, not in the actual config.php used for everything.

As a result, I had to manually go and change the password in config.php to the updated the password. (using sed because the container has no good file editor)

It appears this is just a problem with autoconfig.php/nextcloud in general (not a bug, just a rough edge). There appears to be a solution to allow using any variables configured with NC_ as a prefix to override values in the config.php.

a reasonable solution here moving forward, I think, is to pass a secret with env vars to the helm chart with the associated variables set as you CAN load a k8s secret map with all the keys as just ENV vars automatically. This may take some changes to the helm chart however. for now I have aworking deployment and will save this for later if necessary.

(note for future me, check config.php for the env vars to set, they are different from autoconfig.php)