46 lines
2.1 KiB
Bash
46 lines
2.1 KiB
Bash
#!/usr/bin/env bash
|
|
set -e
|
|
|
|
APP_DB_USER="${APP_DB_USER:-vignette_app}"
|
|
APP_DB_PASSWORD="${APP_DB_PASSWORD:-vignette_app}"
|
|
|
|
case "$APP_DB_USER" in
|
|
*[!a-zA-Z0-9_]*)
|
|
echo "APP_DB_USER must contain only letters, numbers, and underscores" >&2
|
|
exit 1
|
|
;;
|
|
esac
|
|
|
|
if psql --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" -tAc "SELECT 1 FROM pg_roles WHERE rolname = '$APP_DB_USER'" | grep -q 1; then
|
|
psql --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" \
|
|
-v app_user="$APP_DB_USER" \
|
|
-v app_password="$APP_DB_PASSWORD" <<'EOSQL'
|
|
ALTER ROLE :"app_user" WITH LOGIN PASSWORD :'app_password' NOBYPASSRLS;
|
|
EOSQL
|
|
else
|
|
psql --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" \
|
|
-v app_user="$APP_DB_USER" \
|
|
-v app_password="$APP_DB_PASSWORD" <<'EOSQL'
|
|
CREATE ROLE :"app_user" WITH LOGIN PASSWORD :'app_password' NOBYPASSRLS;
|
|
EOSQL
|
|
fi
|
|
|
|
psql --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" \
|
|
-v app_user="$APP_DB_USER" \
|
|
-v db_name="$POSTGRES_DB" <<'EOSQL'
|
|
GRANT CONNECT ON DATABASE :"db_name" TO :"app_user";
|
|
GRANT USAGE ON SCHEMA app, kb, audit, ds TO :"app_user";
|
|
GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA app, kb, audit, ds TO :"app_user";
|
|
GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA app, kb, audit, ds TO :"app_user";
|
|
GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA app TO :"app_user";
|
|
|
|
ALTER DEFAULT PRIVILEGES IN SCHEMA app GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO :"app_user";
|
|
ALTER DEFAULT PRIVILEGES IN SCHEMA kb GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO :"app_user";
|
|
ALTER DEFAULT PRIVILEGES IN SCHEMA audit GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO :"app_user";
|
|
ALTER DEFAULT PRIVILEGES IN SCHEMA ds GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO :"app_user";
|
|
ALTER DEFAULT PRIVILEGES IN SCHEMA app GRANT USAGE, SELECT ON SEQUENCES TO :"app_user";
|
|
ALTER DEFAULT PRIVILEGES IN SCHEMA kb GRANT USAGE, SELECT ON SEQUENCES TO :"app_user";
|
|
ALTER DEFAULT PRIVILEGES IN SCHEMA audit GRANT USAGE, SELECT ON SEQUENCES TO :"app_user";
|
|
ALTER DEFAULT PRIVILEGES IN SCHEMA ds GRANT USAGE, SELECT ON SEQUENCES TO :"app_user";
|
|
ALTER DEFAULT PRIVILEGES IN SCHEMA app GRANT EXECUTE ON FUNCTIONS TO :"app_user";
|
|
EOSQL
|