Nasim SadatandClaude Opus 5.5
8405706ed8
trino/ deleted; the role trino_ro becomes fuel_ro, its password read from a secret file at connect time; dashboards' SQL and column list for PostgreSQL; the Compose project is renamed petrolyst, with volumes pinned to their old names. AGENTS.md points to the architecture context. Not deployed: the next deploy needs README's one-time steps first. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
29 lines
1.3 KiB
Bash
Executable File
29 lines
1.3 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Runs once, when the fuel-db volume is first initialised (mounted after the
|
|
# image's own TimescaleDB scripts, as 010_petrolyst_roles.sh).
|
|
# fuel_owner owns database "fuel", its public schema and every table in it.
|
|
# Loaders log in as their own role but act as fuel_owner (README
|
|
# "Data loaders"): the default privileges below cover only what
|
|
# fuel_owner itself creates, not what its members create.
|
|
# fuel_ro what Superset and the Petrolyst server read as: SELECT on public,
|
|
# also on tables created later. Read-only by default as well: a
|
|
# second lock behind the grants.
|
|
set -euo pipefail
|
|
|
|
ro_password=$(cat /run/secrets/fuel_db_ro_password)
|
|
|
|
psql -v ON_ERROR_STOP=1 --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" \
|
|
-v ro_password="$ro_password" <<'SQL'
|
|
CREATE ROLE fuel_owner NOLOGIN;
|
|
ALTER DATABASE fuel OWNER TO fuel_owner;
|
|
REVOKE CREATE ON SCHEMA public FROM PUBLIC;
|
|
|
|
CREATE ROLE fuel_ro LOGIN PASSWORD :'ro_password';
|
|
ALTER ROLE fuel_ro SET default_transaction_read_only = on;
|
|
GRANT CONNECT ON DATABASE fuel TO fuel_ro;
|
|
GRANT USAGE ON SCHEMA public TO fuel_ro;
|
|
GRANT SELECT ON ALL TABLES IN SCHEMA public TO fuel_ro;
|
|
ALTER DEFAULT PRIVILEGES FOR ROLE fuel_owner IN SCHEMA public
|
|
GRANT SELECT ON TABLES TO fuel_ro;
|
|
SQL
|