diff --git a/ci.docker-compose.yml b/ci.docker-compose.yml
index 6cbb456..336856a 100644
--- a/ci.docker-compose.yml
+++ b/ci.docker-compose.yml
@@ -11,6 +11,7 @@ services:
       - SENTRY=True
       - PGSSLMODE=require
       - DB_NAME=${BUILD_NAME}
+      - DB_HOST=TODO
     labels:
       - "traefik.enable=true"
       - "traefik.http.routers.${COMPOSE_PROJECT_NAME}.rule=Host(`${DOMAIN}`)"
diff --git a/clear-ci.secrets.docker-compose.yml b/clear-ci.secrets.docker-compose.yml
index 5083b9a..6af525c 100644
--- a/clear-ci.secrets.docker-compose.yml
+++ b/clear-ci.secrets.docker-compose.yml
@@ -1,9 +1,10 @@
 # never commit this file
 # only to set secrets
-# encrypt me with sops --age $KEYGENERATEDINCI --encrypt clear-ci.secrets.docker-compose.yml > ci.secrets.docker-compose.yml
+# encrypt me with:
+# sops --age $KEYGENERATEDINCI --encrypt clear-ci.secrets.docker-compose.yml > ci.secrets.docker-compose.yml
 version: "3.7"
 services:
   odoo:
     environment:
-      - PGPASSWORD=
+      - DB_PASSWORD=
       - ENCRYPTION_KEY_CI=
diff --git a/clear-prod.secrets.docker-compose.yml b/clear-prod.secrets.docker-compose.yml
index 0deb333..4b70621 100644
--- a/clear-prod.secrets.docker-compose.yml
+++ b/clear-prod.secrets.docker-compose.yml
@@ -1,9 +1,11 @@
 # never commit this file
-# only to set secrets
-# encrypt me with sops --age $KEYGENERATEDINPROD --encrypt clear-prod.secrets.docker-compose.yml > prod.secrets.docker-compose.yml
+# only used to set secrets
+# encrypt me with:
+# sops --age $KEYGENERATEDINPROD --encrypt clear-prod.secrets.docker-compose.yml > prod.secrets.docker-compose.yml
 version: "3.7"
 services:
   odoo:
     environment:
       - DB_PASSWORD=
       - ENCRYPTION_KEY_CI=
+      - ENCRYPTION_KEY_PROD=