Nasim SadatandClaude Opus 5.5
d3800ac9dd
Traefik as the server-wide edge (TLS via Let's Encrypt, dashboard on traefik.petrolyst.com behind oauth2-proxy and Keycloak). The fuel-monitoring stack: Superset on atoma.petrolyst.com with Keycloak login and Petrolyst branding, Trino reading the TimescaleDB fuel-db as catalog "fuel". Customization lives in petrolyst-insights/, deployment in the other folders. Deploys run server-side (deploy/deploy.sh) from a Gitea workflow or manually; releases are immutable, Superset metadata is backed up before migrations, and deploy/rollback.sh restores it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
26 lines
1.1 KiB
Bash
Executable File
26 lines
1.1 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Runs once, when the fuel-db volume is first initialised (mounted after the
|
|
# image's own TimescaleDB scripts, as 010_petrolyst_roles.sh).
|
|
# fuel_owner owns database "fuel", its public schema and every table in it.
|
|
# Loaders log in as their own role but act as fuel_owner (README
|
|
# "Data loaders"): the default privileges below cover only what
|
|
# fuel_owner itself creates, not what its members create.
|
|
# trino_ro what Trino connects as: read-only, also on tables created later.
|
|
set -euo pipefail
|
|
|
|
trino_password=$(cat /run/secrets/fuel_db_trino_password)
|
|
|
|
psql -v ON_ERROR_STOP=1 --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" \
|
|
-v trino_password="$trino_password" <<'SQL'
|
|
CREATE ROLE fuel_owner NOLOGIN;
|
|
ALTER DATABASE fuel OWNER TO fuel_owner;
|
|
REVOKE CREATE ON SCHEMA public FROM PUBLIC;
|
|
|
|
CREATE ROLE trino_ro LOGIN PASSWORD :'trino_password';
|
|
GRANT CONNECT ON DATABASE fuel TO trino_ro;
|
|
GRANT USAGE ON SCHEMA public TO trino_ro;
|
|
GRANT SELECT ON ALL TABLES IN SCHEMA public TO trino_ro;
|
|
ALTER DEFAULT PRIVILEGES FOR ROLE fuel_owner IN SCHEMA public
|
|
GRANT SELECT ON TABLES TO trino_ro;
|
|
SQL
|