R524809
23 lines
1.4 KiB
Bash
Executable File
23 lines
1.4 KiB
Bash
Executable File
#!/bin/sh
|
|
set -eu
|
|
|
|
# 只在官方镜像首次初始化空数据卷时执行。psql 引用变量，密码不进入 SQL 字面拼接或输出。
|
|
: "${DOODLE_MIGRATOR_PASSWORD:?缺少迁移账号密码}"
|
|
: "${DOODLE_APP_PASSWORD:?缺少应用账号密码}"
|
|
psql --username "$POSTGRES_USER" --dbname postgres --set ON_ERROR_STOP=1 <<'SQL'
|
|
\getenv migration_password DOODLE_MIGRATOR_PASSWORD
|
|
\getenv application_password DOODLE_APP_PASSWORD
|
|
CREATE ROLE doodle_migrator LOGIN PASSWORD :'migration_password' NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION;
|
|
CREATE ROLE doodle_app LOGIN PASSWORD :'application_password' NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION;
|
|
CREATE DATABASE doodle_prod OWNER doodle_migrator ENCODING 'UTF8' LC_COLLATE 'C' LC_CTYPE 'C' TEMPLATE template0;
|
|
REVOKE ALL ON DATABASE doodle_prod FROM PUBLIC;
|
|
GRANT CONNECT ON DATABASE doodle_prod TO doodle_migrator, doodle_app;
|
|
\connect doodle_prod
|
|
REVOKE ALL ON SCHEMA public FROM PUBLIC;
|
|
GRANT USAGE ON SCHEMA public TO doodle_app;
|
|
-- 迁移由 doodle_migrator 执行：后续创建的表自动赋予应用 DML 权限，不授予建表或删表权限。
|
|
ALTER DEFAULT PRIVILEGES FOR ROLE doodle_migrator IN SCHEMA public GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO doodle_app;
|
|
ALTER DEFAULT PRIVILEGES FOR ROLE doodle_migrator IN SCHEMA public GRANT USAGE, SELECT ON SEQUENCES TO doodle_app;
|
|
REVOKE ALL ON DATABASE postgres FROM PUBLIC;
|
|
SQL
|