diff --git a/modules/common/main.tf b/modules/common/main.tf
index 27be574..0a46756 100644
--- a/modules/common/main.tf
+++ b/modules/common/main.tf
@@ -52,7 +52,13 @@ resource "azurerm_postgresql_flexible_server" "tikweb_pg_new" {
   auto_grow_enabled            = false
   zone                         = "2"
 }
-
+# very secure accesses yes
+resource "azurerm_postgresql_flexible_server_firewall_rule" "tikweb_pg_new_firewall" {
+  name             = "tikweb-${var.env_name}-pg-new"
+  server_id        = azurerm_postgresql_flexible_server.tikweb_pg_new.id
+  start_ip_address = "0.0.0.0"
+  end_ip_address   = "0.0.0.0"
+}
 # Enable access from other Azure services
 resource "azurerm_postgresql_firewall_rule" "tikweb_pg_internal_access" {
   name                = "tikweb-${var.env_name}-pg-internal-access"
diff --git a/modules/keyvault/main.tf b/modules/keyvault/main.tf
index 09e22fb..e30f0c1 100644
--- a/modules/keyvault/main.tf
+++ b/modules/keyvault/main.tf
@@ -13,11 +13,15 @@ resource "azurerm_key_vault" "keyvault" {
 
 
 }
+data "azuread_application" "CI_app_registration" {
+  display_name = "github-action-terraform"
+}
+
 
 resource "azurerm_key_vault_access_policy" "current" {
   key_vault_id = azurerm_key_vault.keyvault.id
   tenant_id    = data.azurerm_client_config.current.tenant_id
-  object_id    = data.azurerm_client_config.current.object_id
+  object_id    = data.azuread_application.CI_app_registration.id
 
   key_permissions = [
     "Get",
@@ -80,53 +84,57 @@ data "azurerm_key_vault_secret" "strapi_api_token_salt" {
 data "azurerm_key_vault_secret" "strapi_app_keys" {
   name         = "strapi-app-keys"
   key_vault_id = azurerm_key_vault.keyvault.id
-  depends_on   = [azurerm_key_vault_access_policy.admin, azurerm_key_vault_access_policy.current]
 }
 
 data "azurerm_key_vault_secret" "ilmo_auth_jwt_secret" {
   name         = "ilmo-auth-jwt-secret"
   key_vault_id = azurerm_key_vault.keyvault.id
-  depends_on   = [azurerm_key_vault_access_policy.admin, azurerm_key_vault_access_policy.current]
 }
 
 data "azurerm_key_vault_secret" "ilmo_edit_token_secret" {
   name         = "ilmo-edit-token-secret"
   key_vault_id = azurerm_key_vault.keyvault.id
-  depends_on   = [azurerm_key_vault_access_policy.admin, azurerm_key_vault_access_policy.current]
 }
 
 data "azurerm_key_vault_secret" "ilmo_mailgun_api_key" {
   name         = "ilmo-mailgun-api-key"
   key_vault_id = azurerm_key_vault.keyvault.id
-  depends_on   = [azurerm_key_vault_access_policy.admin, azurerm_key_vault_access_policy.current]
 }
 
 data "azurerm_key_vault_secret" "ilmo_mailgun_domain" {
   name         = "ilmo-mailgun-domain"
   key_vault_id = azurerm_key_vault.keyvault.id
-  depends_on   = [azurerm_key_vault_access_policy.admin, azurerm_key_vault_access_policy.current]
 }
 
 data "azurerm_key_vault_secret" "tikjob_ghost_mail_username" {
   name         = "tikjob-ghost-mail-username"
   key_vault_id = azurerm_key_vault.keyvault.id
-  depends_on   = [azurerm_key_vault_access_policy.admin, azurerm_key_vault_access_policy.current]
 }
 
 data "azurerm_key_vault_secret" "tikjob_ghost_mail_password" {
   name         = "tikjob-ghost-mail-password"
   key_vault_id = azurerm_key_vault.keyvault.id
-  depends_on   = [azurerm_key_vault_access_policy.admin, azurerm_key_vault_access_policy.current]
 }
 
 data "azurerm_key_vault_secret" "tenttiarkisto_django_secret_key" {
   name         = "tenttiarkisto-django-secret-key"
   key_vault_id = azurerm_key_vault.keyvault.id
-  depends_on   = [azurerm_key_vault_access_policy.admin, azurerm_key_vault_access_policy.current]
 }
 
 data "azurerm_key_vault_secret" "github_app_key" {
   name         = "github-app-key"
   key_vault_id = azurerm_key_vault.keyvault.id
+}
+
+resource "azurerm_key_vault_secret" "postgres_admin_username" {
+  key_vault_id = azurerm_key_vault.keyvault.id
+  name         = "postgres-admin-username"
+  value        = var.tikweb_postgres_admin_username
+  depends_on   = [azurerm_key_vault_access_policy.admin, azurerm_key_vault_access_policy.current]
+}
+resource "azurerm_key_vault_secret" "postgres_admin_password" {
+  key_vault_id = azurerm_key_vault.keyvault.id
+  name         = "postgres-admin-password"
+  value        = var.tikweb_postgres_admin_password
   depends_on   = [azurerm_key_vault_access_policy.admin, azurerm_key_vault_access_policy.current]
 }
diff --git a/modules/keyvault/output.tf b/modules/keyvault/output.tf
index 6741be6..4eeb89a 100644
--- a/modules/keyvault/output.tf
+++ b/modules/keyvault/output.tf
@@ -44,3 +44,9 @@ output "tenttiarkisto_django_secret_key" {
 output "github_app_key" {
   value = data.azurerm_key_vault_secret.github_app_key.value
 }
+output "tikweb_postgres_admin_password" {
+  value = azurerm_key_vault_secret.postgres_admin_password
+}
+output "tikweb_postgres_admin_username" {
+  value = azurerm_key_vault_secret.postgres_admin_username
+}