fix(content): repair Django tutorial crash and complete the hardening sweep

Follow-ups to the 9 secret-hardening commits (each verified against
docs.docker.com / vendor docs; one outright new bug found and fixed):

- 11.6: eb5e4397 changed settings.py to a hard os.environ lookup but the
  web service never receives POSTGRES_PASSWORD (only db does; DATABASE_URL
  is set but never read) -> step-6 'docker compose up' crashed with
  KeyError. Pass the var to web; harden the leftover literal password in
  the 配置详解 snippet that contradicted the new guidance two lines down;
  blank line after the inserted sentence (bold heading merged into the
  paragraph); dev/prod table no longer claims dev uses 明文 passwords
- 11.8: FAQ still told readers to check passwords in .env after the same
  file banned passwords in .env -> point at secrets/db_password.txt;
  backup sidecar env vars updated to tiredofit/db-backup 4.x interface
  (DB01_* + DB01_PASS_FILE + DB01_BACKUP_INTERVAL - the unprefixed DB_*
  names are ignored by current :latest; verified against upstream README)
- demo/wordpress: compose now references secrets files that ship nowhere
  -> add README with the creation commands from 11.8; demo/django: align
  with the hardened 11.6 (env-injected password, passed to web too)
- 04_image multistage demos: go build without go.mod fails on module-mode
  Go (reproduced by reviewer on go1.26) -> add 'go mod init helloworld'
  matching the 7.17 doc pattern in all three Dockerfiles
- 21.7: init script reworked init-db.sql -> init-db.sh per the official
  image's env-reading .sh hook - removes the baked 'secure_password' AND
  the CREATE DATABASE myappdb collision with POSTGRES_DB that aborted
  first-boot init (ON_ERROR_STOP); compose passes APP_DB_PASSWORD;
  microservices init.sql mount annotated schema-only (POSTGRES_USER:
  appuser would collide with CREATE USER); Dockerfile-redis healthcheck
  now authenticates via REDISCLI_AUTH read from redis.conf (plain
  redis-cli ping gets NOAUTH against requirepass - same class as the
  compose sibling eb5e4397 already fixed); dev-container dev/dev creds
  annotated local-only
- 19.3: Grafana admin password 'admin' sat directly under the newly added
  security warning -> env-injected like the rest of the stack

21_case_devops/21.7_practical_examples.md

@@ -291,8 +291,8 @@ RUN apk add --no-cache \
     pg-stat-monitor \
     curl
 
-# 复制初始化脚本
-COPY init-db.sql /docker-entrypoint-initdb.d/
+# 复制初始化脚本（.sh 形式可从环境变量读取密码，避免在 SQL 中写明文）
+COPY init-db.sh /docker-entrypoint-initdb.d/
 COPY health-check.sh /
 
 RUN chmod +x /health-check.sh
@@ -302,40 +302,42 @@ HEALTHCHECK --interval=10s --timeout=5s --start-period=40s --retries=3 \
 
 EXPOSE 5432
 ```
-**初始化脚本（init-db.sql）：**
+**初始化脚本（init-db.sh）：**
 
-```sql
--- 创建自定义用户
-CREATE USER appuser WITH PASSWORD 'secure_password';
+官方镜像会执行 `/docker-entrypoint-initdb.d/` 下的 `.sh` 脚本，因此应用用户的密码可以从环境变量注入，而不必写进 SQL；数据库 `myappdb` 已由入口脚本按 `POSTGRES_DB` 创建，初始化脚本中不要重复 `CREATE DATABASE`（否则首次初始化会因冲突而中止）。
 
--- 创建数据库
-CREATE DATABASE myappdb OWNER appuser;
+```bash
+#!/bin/bash
+set -e
 
--- 创建扩展
-\c myappdb
+psql -v ON_ERROR_STOP=1 -U "$POSTGRES_USER" -d "$POSTGRES_DB" <<-EOSQL
+    -- 创建应用用户（密码来自环境变量 APP_DB_PASSWORD）
+    CREATE USER appuser WITH PASSWORD '$APP_DB_PASSWORD';
 
-CREATE EXTENSION IF NOT EXISTS "uuid-ossp";
-CREATE EXTENSION IF NOT EXISTS hstore;
-CREATE EXTENSION IF NOT EXISTS pg_trgm;
+    -- 创建扩展
+    CREATE EXTENSION IF NOT EXISTS "uuid-ossp";
+    CREATE EXTENSION IF NOT EXISTS hstore;
+    CREATE EXTENSION IF NOT EXISTS pg_trgm;
 
--- 创建表
-CREATE TABLE users (
-    id UUID PRIMARY KEY DEFAULT uuid_generate_v4(),
-    username VARCHAR(255) NOT NULL UNIQUE,
-    email VARCHAR(255) NOT NULL UNIQUE,
-    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
-    updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
-);
+    -- 创建表
+    CREATE TABLE users (
+        id UUID PRIMARY KEY DEFAULT uuid_generate_v4(),
+        username VARCHAR(255) NOT NULL UNIQUE,
+        email VARCHAR(255) NOT NULL UNIQUE,
+        created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+        updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
+    );
 
--- 创建索引
-CREATE INDEX idx_users_username ON users (username);
-CREATE INDEX idx_users_email ON users (email);
+    -- 创建索引
+    CREATE INDEX idx_users_username ON users (username);
+    CREATE INDEX idx_users_email ON users (email);
 
--- 授予权限
-GRANT CONNECT ON DATABASE myappdb TO appuser;
-GRANT USAGE ON SCHEMA public TO appuser;
-GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA public TO appuser;
-GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA public TO appuser;
+    -- 授予权限
+    GRANT CONNECT ON DATABASE $POSTGRES_DB TO appuser;
+    GRANT USAGE ON SCHEMA public TO appuser;
+    GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA public TO appuser;
+    GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA public TO appuser;
+EOSQL
 ```
 **健康检查脚本（health-check.sh）：**
 
@@ -363,6 +365,7 @@ services:
       POSTGRES_DB: myappdb
       POSTGRES_USER: postgres
       POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD in .env}
+      APP_DB_PASSWORD: ${APP_DB_PASSWORD:?set APP_DB_PASSWORD in .env}
       POSTGRES_INITDB_ARGS: "--encoding=UTF8 --locale=en_US.UTF-8"
     volumes:
       - postgres_data:/var/lib/postgresql/data
@@ -510,8 +513,10 @@ CMD ["redis-server", "/usr/local/etc/redis/redis.conf"]
 
 EXPOSE 6379
 
+# redis.conf 启用了 requirepass，健康检查必须带认证，否则只会收到 NOAUTH 错误
+# REDISCLI_AUTH 可避免把密码出现在进程参数中
 HEALTHCHECK --interval=5s --timeout=3s --retries=5 \
-    CMD redis-cli ping || exit 1
+    CMD sh -c 'REDISCLI_AUTH="$(awk "/^requirepass /{print \$2}" /usr/local/etc/redis/redis.conf)" redis-cli ping | grep -q PONG'
 ```
 **redis.conf 配置：**
 
@@ -522,7 +527,7 @@ bind 0.0.0.0
 # 端口
 port 6379
 
-# 密码保护
+# 密码保护（示例占位值，部署时应替换并避免提交到版本库）
 requirepass your_secure_password
 
 # 内存管理
@@ -621,6 +626,8 @@ services:
       POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD}
     volumes:
       - postgres_data:/var/lib/postgresql/data
+      # 此处的 init.sql 只放建表/索引等 schema 语句；
+      # 用户与数据库已由 POSTGRES_USER/POSTGRES_DB 创建，脚本中不要重复 CREATE USER/DATABASE
       - ./db/init.sql:/docker-entrypoint-initdb.d/init.sql
     networks:
       - backend-network
@@ -844,6 +851,7 @@ services:
   postgres:
     image: postgres:16-alpine
     environment:
+      # 仅限本机 Dev Container 的一次性开发凭证，不要在任何共享/联网环境复用
       POSTGRES_USER: dev
       POSTGRES_PASSWORD: dev
       POSTGRES_DB: myapp