55 lines
2.6 KiB
Bash
Executable File
55 lines
2.6 KiB
Bash
Executable File
#!/bin/sh
|
|
set -eu
|
|
|
|
. /opt/thoth/secret-policy.sh
|
|
|
|
bundle=${THT_SECRETS_FILE:-/run/secrets/thothii.secrets}
|
|
export PGPASSWORD=$(read_bundle_secret "$bundle" THT_VECTOR_BOOTSTRAP_PASSWORD)
|
|
migrator_password=$(read_bundle_secret "$bundle" THT_VECTOR_MIGRATOR_PASSWORD)
|
|
reader_password=$(read_bundle_secret "$bundle" THT_VECTOR_READER_PASSWORD)
|
|
writer_password=$(read_bundle_secret "$bundle" THT_VECTOR_WRITER_PASSWORD)
|
|
|
|
psql --set=ON_ERROR_STOP=1 \
|
|
--set=migrator_user="$THT_VECTOR_MIGRATOR_USER" \
|
|
--set=migrator_password="$migrator_password" \
|
|
--set=reader_user="$THT_VECTOR_READER_USER" \
|
|
--set=reader_password="$reader_password" \
|
|
--set=writer_user="$THT_VECTOR_WRITER_USER" \
|
|
--set=writer_password="$writer_password" <<'SQL'
|
|
SELECT 'CREATE ROLE vector_reader NOLOGIN'
|
|
WHERE NOT EXISTS (SELECT FROM pg_catalog.pg_roles WHERE rolname = 'vector_reader') \gexec
|
|
SELECT 'CREATE ROLE vector_writer NOLOGIN'
|
|
WHERE NOT EXISTS (SELECT FROM pg_catalog.pg_roles WHERE rolname = 'vector_writer') \gexec
|
|
ALTER ROLE vector_reader NOLOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION;
|
|
ALTER ROLE vector_writer NOLOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION;
|
|
|
|
SELECT format('CREATE ROLE %I LOGIN', :'migrator_user')
|
|
WHERE NOT EXISTS (SELECT FROM pg_catalog.pg_roles WHERE rolname = :'migrator_user') \gexec
|
|
SELECT format('CREATE ROLE %I LOGIN', :'reader_user')
|
|
WHERE NOT EXISTS (SELECT FROM pg_catalog.pg_roles WHERE rolname = :'reader_user') \gexec
|
|
SELECT format('CREATE ROLE %I LOGIN', :'writer_user')
|
|
WHERE NOT EXISTS (SELECT FROM pg_catalog.pg_roles WHERE rolname = :'writer_user') \gexec
|
|
|
|
SELECT format(
|
|
'ALTER ROLE %I LOGIN PASSWORD %L NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION',
|
|
:'migrator_user', :'migrator_password'
|
|
) \gexec
|
|
SELECT format(
|
|
'ALTER ROLE %I LOGIN PASSWORD %L NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION',
|
|
:'reader_user', :'reader_password'
|
|
) \gexec
|
|
SELECT format(
|
|
'ALTER ROLE %I LOGIN PASSWORD %L NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION',
|
|
:'writer_user', :'writer_password'
|
|
) \gexec
|
|
|
|
SELECT format('GRANT vector_reader TO %I', :'reader_user') \gexec
|
|
SELECT format('GRANT vector_writer TO %I', :'writer_user') \gexec
|
|
SELECT format('ALTER DATABASE %I OWNER TO %I', current_database(), :'migrator_user') \gexec
|
|
SELECT format('CREATE SCHEMA IF NOT EXISTS vectors AUTHORIZATION %I', :'migrator_user') \gexec
|
|
SELECT format('ALTER SCHEMA vectors OWNER TO %I', :'migrator_user') \gexec
|
|
REVOKE ALL ON SCHEMA vectors FROM PUBLIC;
|
|
GRANT USAGE ON SCHEMA vectors TO vector_reader, vector_writer;
|
|
CREATE EXTENSION IF NOT EXISTS vector WITH SCHEMA vectors;
|
|
SQL
|