rob thijssen
e40d6b0e44
Idempotent SQL for role and database creation, split between the
postgres-database scope (bootstrap.sql) and the moments-database
scope (bootstrap-moments.sql), since CREATE DATABASE can't run
inside a DO block or transaction.
Roles:
moments_rw — owner of the moments database; runs migrations
and writes events from moments-worker.
moments_ro — read-only; consumed by moments-api.
The pg_ident template is rendered per-host by deploy.sh once it
lands; one (host, role) mapping per file. Reload required on both
magrathea and frankie after install — pg_ident is not replicated.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
27 lines
863 B
SQL
27 lines
863 B
SQL
-- moments role and database bootstrap.
|
|
-- Run as a postgres superuser against the cluster's `postgres` database.
|
|
-- Idempotent — safe to re-run on every deploy.
|
|
--
|
|
-- psql -h magrathea.kosherinata.internal -U postgres -d postgres \
|
|
-- -f asset/sql/bootstrap.sql
|
|
--
|
|
-- After this completes, run asset/sql/bootstrap-moments.sql against the
|
|
-- newly created `moments` database to apply the in-database grants.
|
|
|
|
DO $$
|
|
BEGIN
|
|
IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = 'moments_rw') THEN
|
|
CREATE ROLE moments_rw LOGIN;
|
|
END IF;
|
|
IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = 'moments_ro') THEN
|
|
CREATE ROLE moments_ro LOGIN;
|
|
END IF;
|
|
END
|
|
$$;
|
|
|
|
SELECT 'CREATE DATABASE moments OWNER moments_rw'
|
|
WHERE NOT EXISTS (SELECT FROM pg_database WHERE datname = 'moments')
|
|
\gexec
|
|
|
|
GRANT CONNECT ON DATABASE moments TO moments_ro, moments_rw;
|