feat: 部署准备

deploy/postgres/10-create-roles.sh

@@ -0,0 +1,22 @@
+#!/bin/sh
+set -eu
+
+# 只在官方镜像首次初始化空数据卷时执行。psql 引用变量，密码不进入 SQL 字面拼接或输出。
+: "${DOODLE_MIGRATOR_PASSWORD:?缺少迁移账号密码}"
+: "${DOODLE_APP_PASSWORD:?缺少应用账号密码}"
+psql --username "$POSTGRES_USER" --dbname postgres --set ON_ERROR_STOP=1 <<'SQL'
+\getenv migration_password DOODLE_MIGRATOR_PASSWORD
+\getenv application_password DOODLE_APP_PASSWORD
+CREATE ROLE doodle_migrator LOGIN PASSWORD :'migration_password' NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION;
+CREATE ROLE doodle_app LOGIN PASSWORD :'application_password' NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION;
+CREATE DATABASE doodle_prod OWNER doodle_migrator ENCODING 'UTF8' LC_COLLATE 'C' LC_CTYPE 'C' TEMPLATE template0;
+REVOKE ALL ON DATABASE doodle_prod FROM PUBLIC;
+GRANT CONNECT ON DATABASE doodle_prod TO doodle_migrator, doodle_app;
+\connect doodle_prod
+REVOKE ALL ON SCHEMA public FROM PUBLIC;
+GRANT USAGE ON SCHEMA public TO doodle_app;
+-- 迁移由 doodle_migrator 执行：后续创建的表自动赋予应用 DML 权限，不授予建表或删表权限。
+ALTER DEFAULT PRIVILEGES FOR ROLE doodle_migrator IN SCHEMA public GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO doodle_app;
+ALTER DEFAULT PRIVILEGES FOR ROLE doodle_migrator IN SCHEMA public GRANT USAGE, SELECT ON SEQUENCES TO doodle_app;
+REVOKE ALL ON DATABASE postgres FROM PUBLIC;
+SQL