Sergei Poljanski
b6bcc9f882
All checks were successful
Deploy storage stack / deploy (push) Successful in 19s
The public bingo site is moving out of the asxpio container and only needs to read the bingo tables and the bingo/ photos. Give it a role limited to SELECT on those two tables (with read-only transactions by default) and a MinIO user limited to GetObject under asxpio-invoices/bingo/, instead of reusing asxpio's read-write credentials. Both steps are skipped while the BINGO_* secrets are unset, so this deploys safely before they exist. Tables missing on a fresh install are granted on the next deploy. Assisted-by: Claude:opus-5
61 lines
1.8 KiB
Bash
61 lines
1.8 KiB
Bash
#!/bin/sh
|
|
# Idempotent bootstrap: create per-app roles and databases.
|
|
# Re-running is safe — checks before creating, updates passwords if changed.
|
|
set -eu
|
|
|
|
ensure_role() {
|
|
role="$1"
|
|
password="$2"
|
|
exists=$(psql -tAc "SELECT 1 FROM pg_roles WHERE rolname='${role}'")
|
|
if [ "${exists}" = "1" ]; then
|
|
psql -c "ALTER ROLE \"${role}\" WITH LOGIN PASSWORD '${password}';"
|
|
else
|
|
psql -c "CREATE ROLE \"${role}\" WITH LOGIN PASSWORD '${password}';"
|
|
fi
|
|
}
|
|
|
|
ensure_db() {
|
|
db="$1"
|
|
owner="$2"
|
|
exists=$(psql -tAc "SELECT 1 FROM pg_database WHERE datname='${db}'")
|
|
if [ "${exists}" != "1" ]; then
|
|
psql -c "CREATE DATABASE \"${db}\" OWNER \"${owner}\";"
|
|
fi
|
|
}
|
|
|
|
ensure_extension() {
|
|
db="$1"
|
|
ext="$2"
|
|
psql -d "${db}" -c "CREATE EXTENSION IF NOT EXISTS \"${ext}\";"
|
|
}
|
|
|
|
ensure_role "asxpio" "${ASXPIO_DB_PASSWORD}"
|
|
ensure_db "asxpio" "asxpio"
|
|
ensure_extension "asxpio" "citext"
|
|
|
|
# datacenterbingo: read-only on the bingo tables in the asxpio DB (asxpio's
|
|
# admin writes them and owns the schema). Tables that don't exist yet (fresh
|
|
# install, asxpio not migrated) are granted on the next storage deploy.
|
|
if [ -n "${BINGO_DB_PASSWORD:-}" ]; then
|
|
ensure_role "bingo" "${BINGO_DB_PASSWORD}"
|
|
psql -c "ALTER ROLE bingo SET default_transaction_read_only = on;"
|
|
psql -d asxpio -v ON_ERROR_STOP=1 <<'SQL' # heredoc body stays at column 0
|
|
GRANT CONNECT ON DATABASE asxpio TO bingo;
|
|
GRANT USAGE ON SCHEMA public TO bingo;
|
|
DO $$
|
|
DECLARE t text;
|
|
BEGIN
|
|
FOREACH t IN ARRAY ARRAY['bingo_datacenters', 'bingo_incidents'] LOOP
|
|
IF to_regclass('public.' || t) IS NOT NULL THEN
|
|
EXECUTE format('GRANT SELECT ON public.%I TO bingo', t);
|
|
ELSE
|
|
RAISE NOTICE 'bingo: % missing, not granted yet', t;
|
|
END IF;
|
|
END LOOP;
|
|
END $$;
|
|
SQL
|
|
else
|
|
echo "postgres-init: BINGO_DB_PASSWORD unset, skipping bingo role"
|
|
fi
|
|
|
|
echo "postgres-init: done"
|