R524809
20 lines
1.1 KiB
Bash
Executable File
20 lines
1.1 KiB
Bash
Executable File
#!/bin/sh
|
|
set -eu
|
|
|
|
: "${ATLAS_MIGRATOR_PASSWORD:?ATLAS_MIGRATOR_PASSWORD is required}"
|
|
: "${ATLAS_APP_PASSWORD:?ATLAS_APP_PASSWORD is required}"
|
|
|
|
psql --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" --set ON_ERROR_STOP=1 \
|
|
--set database_name="$POSTGRES_DB" --set migrator_password="$ATLAS_MIGRATOR_PASSWORD" --set app_password="$ATLAS_APP_PASSWORD" <<-'SQL'
|
|
CREATE ROLE atlas_migrator LOGIN NOINHERIT NOBYPASSRLS PASSWORD :'migrator_password';
|
|
CREATE ROLE atlas_app NOLOGIN NOINHERIT NOBYPASSRLS;
|
|
CREATE ROLE atlas_app_login LOGIN NOINHERIT NOBYPASSRLS PASSWORD :'app_password';
|
|
GRANT atlas_app TO atlas_app_login;
|
|
-- 仅允许迁移角色创建 atlas schema；应用登录角色不拥有数据库级建库权限。
|
|
GRANT CREATE ON DATABASE :"database_name" TO atlas_migrator;
|
|
CREATE SCHEMA atlas AUTHORIZATION atlas_migrator;
|
|
GRANT USAGE ON SCHEMA atlas TO atlas_app;
|
|
ALTER DEFAULT PRIVILEGES FOR ROLE atlas_migrator IN SCHEMA atlas GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO atlas_app;
|
|
ALTER DEFAULT PRIVILEGES FOR ROLE atlas_migrator IN SCHEMA atlas GRANT USAGE, SELECT ON SEQUENCES TO atlas_app;
|
|
SQL
|