lille-vemmelund/home-assistant
1
0
Fork 0
Code Issues 1 Pull Requests 1 Actions Packages Projects 1 Releases Wiki Activity

updated pipeline to be idempotent and added readonly db user

Browse Source
This commit is contained in:
Brian Bjarke Jensen
2026-01-23 23:04:20 +01:00
parent 7f1c463570
commit aaa724164c
1 changed files with 33 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/workflows/setup_database.yml
+33 -6
View File
@@ -12,8 +12,8 @@ jobs:
run: |
sudo apt-get update
sudo apt-get install -y postgresql-client
- name: Create database and user
- name: Create database and users (idempotent)
env:
DB_HOST: ${{ secrets.POSTGRES_HOST }}
DB_PORT: ${{ secrets.POSTGRES_PORT }}
@@ -21,11 +21,35 @@ jobs:
DB_NAME: ${{ secrets.DB_NAME }}
DB_USER: ${{ secrets.DB_USER }}
DB_PASSWORD: ${{ secrets.DB_PASSWORD }}
DB_READONLY_USER: ${{ secrets.DB_READONLY_USER }}
DB_READONLY_PASSWORD: ${{ secrets.DB_READONLY_PASSWORD }}
run: |
psql -h ${DB_HOST} -p ${DB_PORT} -U postgres -c "CREATE DATABASE ${DB_NAME};"
psql -h ${DB_HOST} -p ${DB_PORT} -U postgres -c "CREATE USER ${DB_USER} WITH PASSWORD '${DB_PASSWORD}';"
# Create database if it doesn't exist
psql -h ${DB_HOST} -p ${DB_PORT} -U postgres -tc "SELECT 1 FROM pg_database WHERE datname = '${DB_NAME}'" | grep -q 1 || \
psql -h ${DB_HOST} -p ${DB_PORT} -U postgres -c "CREATE DATABASE ${DB_NAME};"
# Create admin user if it doesn't exist
psql -h ${DB_HOST} -p ${DB_PORT} -U postgres -tc "SELECT 1 FROM pg_user WHERE usename = '${DB_USER}'" | grep -q 1 || \
psql -h ${DB_HOST} -p ${DB_PORT} -U postgres -c "CREATE USER ${DB_USER} WITH PASSWORD '${DB_PASSWORD}';"
# Grant all privileges on database to admin user
psql -h ${DB_HOST} -p ${DB_PORT} -U postgres -c "GRANT ALL PRIVILEGES ON DATABASE ${DB_NAME} TO ${DB_USER};"
# Grant schema privileges to admin user
psql -h ${DB_HOST} -p ${DB_PORT} -U postgres -d ${DB_NAME} -c "GRANT ALL PRIVILEGES ON SCHEMA public TO ${DB_USER};"
psql -h ${DB_HOST} -p ${DB_PORT} -U postgres -d ${DB_NAME} -c "GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA public TO ${DB_USER};"
psql -h ${DB_HOST} -p ${DB_PORT} -U postgres -d ${DB_NAME} -c "ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL PRIVILEGES ON TABLES TO ${DB_USER};"
# Create read-only user if it doesn't exist
psql -h ${DB_HOST} -p ${DB_PORT} -U postgres -tc "SELECT 1 FROM pg_user WHERE usename = '${DB_READONLY_USER}'" | grep -q 1 || \
psql -h ${DB_HOST} -p ${DB_PORT} -U postgres -c "CREATE USER ${DB_READONLY_USER} WITH PASSWORD '${DB_READONLY_PASSWORD}';"
# Grant read-only privileges to readonly user
psql -h ${DB_HOST} -p ${DB_PORT} -U postgres -c "GRANT CONNECT ON DATABASE ${DB_NAME} TO ${DB_READONLY_USER};"
psql -h ${DB_HOST} -p ${DB_PORT} -U postgres -d ${DB_NAME} -c "GRANT USAGE ON SCHEMA public TO ${DB_READONLY_USER};"
psql -h ${DB_HOST} -p ${DB_PORT} -U postgres -d ${DB_NAME} -c "GRANT SELECT ON ALL TABLES IN SCHEMA public TO ${DB_READONLY_USER};"
psql -h ${DB_HOST} -p ${DB_PORT} -U postgres -d ${DB_NAME} -c "ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT ON TABLES TO ${DB_READONLY_USER};"
- name: Verify setup
env:
DB_HOST: ${{ secrets.POSTGRES_HOST }}
@@ -33,7 +57,10 @@ jobs:
PGPASSWORD: ${{ secrets.POSTGRES_ROOT_PASSWORD }}
DB_NAME: ${{ secrets.DB_NAME }}
DB_USER: ${{ secrets.DB_USER }}
DB_READONLY_USER: ${{ secrets.DB_READONLY_USER }}
run: |
echo "Database setup completed successfully!"
echo "Database:"
psql -h ${DB_HOST} -p ${DB_PORT} -U postgres -c "\l" | grep ${DB_NAME}
psql -h ${DB_HOST} -p ${DB_PORT} -U postgres -c "\du" | grep ${DB_USER}
echo "Users:"
psql -h ${DB_HOST} -p ${DB_PORT} -U postgres -c "\du" | grep -E "${DB_USER}|${DB_READONLY_USER}"