From aaa724164c38b4e449075861b3a5ebe7ecad36ec Mon Sep 17 00:00:00 2001
From: Brian Bjarke Jensen <bbj@skov.dk>
Date: Fri, 23 Jan 2026 23:04:20 +0100
Subject: [PATCH] updated pipeline to be idempotent and added readonly db user

---
 .gitea/workflows/setup_database.yml | 39 ++++++++++++++++++++++++-----
 1 file changed, 33 insertions(+), 6 deletions(-)

diff --git a/.gitea/workflows/setup_database.yml b/.gitea/workflows/setup_database.yml
index f662cd7..e7262c1 100644
--- a/.gitea/workflows/setup_database.yml
+++ b/.gitea/workflows/setup_database.yml
@@ -12,8 +12,8 @@ jobs:
         run: |
           sudo apt-get update
           sudo apt-get install -y postgresql-client
-      
-      - name: Create database and user
+
+      - name: Create database and users (idempotent)
         env:
           DB_HOST: ${{ secrets.POSTGRES_HOST }}
           DB_PORT: ${{ secrets.POSTGRES_PORT }}
@@ -21,11 +21,35 @@ jobs:
           DB_NAME: ${{ secrets.DB_NAME }}
           DB_USER: ${{ secrets.DB_USER }}
           DB_PASSWORD: ${{ secrets.DB_PASSWORD }}
+          DB_READONLY_USER: ${{ secrets.DB_READONLY_USER }}
+          DB_READONLY_PASSWORD: ${{ secrets.DB_READONLY_PASSWORD }}
         run: |
-          psql -h ${DB_HOST} -p ${DB_PORT} -U postgres -c "CREATE DATABASE ${DB_NAME};"
-          psql -h ${DB_HOST} -p ${DB_PORT} -U postgres -c "CREATE USER ${DB_USER} WITH PASSWORD '${DB_PASSWORD}';"
+          # Create database if it doesn't exist
+          psql -h ${DB_HOST} -p ${DB_PORT} -U postgres -tc "SELECT 1 FROM pg_database WHERE datname = '${DB_NAME}'" | grep -q 1 || \
+            psql -h ${DB_HOST} -p ${DB_PORT} -U postgres -c "CREATE DATABASE ${DB_NAME};"
+          
+          # Create admin user if it doesn't exist
+          psql -h ${DB_HOST} -p ${DB_PORT} -U postgres -tc "SELECT 1 FROM pg_user WHERE usename = '${DB_USER}'" | grep -q 1 || \
+            psql -h ${DB_HOST} -p ${DB_PORT} -U postgres -c "CREATE USER ${DB_USER} WITH PASSWORD '${DB_PASSWORD}';"
+          
+          # Grant all privileges on database to admin user
           psql -h ${DB_HOST} -p ${DB_PORT} -U postgres -c "GRANT ALL PRIVILEGES ON DATABASE ${DB_NAME} TO ${DB_USER};"
-      
+          
+          # Grant schema privileges to admin user
+          psql -h ${DB_HOST} -p ${DB_PORT} -U postgres -d ${DB_NAME} -c "GRANT ALL PRIVILEGES ON SCHEMA public TO ${DB_USER};"
+          psql -h ${DB_HOST} -p ${DB_PORT} -U postgres -d ${DB_NAME} -c "GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA public TO ${DB_USER};"
+          psql -h ${DB_HOST} -p ${DB_PORT} -U postgres -d ${DB_NAME} -c "ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL PRIVILEGES ON TABLES TO ${DB_USER};"
+          
+          # Create read-only user if it doesn't exist
+          psql -h ${DB_HOST} -p ${DB_PORT} -U postgres -tc "SELECT 1 FROM pg_user WHERE usename = '${DB_READONLY_USER}'" | grep -q 1 || \
+            psql -h ${DB_HOST} -p ${DB_PORT} -U postgres -c "CREATE USER ${DB_READONLY_USER} WITH PASSWORD '${DB_READONLY_PASSWORD}';"
+          
+          # Grant read-only privileges to readonly user
+          psql -h ${DB_HOST} -p ${DB_PORT} -U postgres -c "GRANT CONNECT ON DATABASE ${DB_NAME} TO ${DB_READONLY_USER};"
+          psql -h ${DB_HOST} -p ${DB_PORT} -U postgres -d ${DB_NAME} -c "GRANT USAGE ON SCHEMA public TO ${DB_READONLY_USER};"
+          psql -h ${DB_HOST} -p ${DB_PORT} -U postgres -d ${DB_NAME} -c "GRANT SELECT ON ALL TABLES IN SCHEMA public TO ${DB_READONLY_USER};"
+          psql -h ${DB_HOST} -p ${DB_PORT} -U postgres -d ${DB_NAME} -c "ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT ON TABLES TO ${DB_READONLY_USER};"
+
       - name: Verify setup
         env:
           DB_HOST: ${{ secrets.POSTGRES_HOST }}
@@ -33,7 +57,10 @@ jobs:
           PGPASSWORD: ${{ secrets.POSTGRES_ROOT_PASSWORD }}
           DB_NAME: ${{ secrets.DB_NAME }}
           DB_USER: ${{ secrets.DB_USER }}
+          DB_READONLY_USER: ${{ secrets.DB_READONLY_USER }}
         run: |
           echo "Database setup completed successfully!"
+          echo "Database:"
           psql -h ${DB_HOST} -p ${DB_PORT} -U postgres -c "\l" | grep ${DB_NAME}
-          psql -h ${DB_HOST} -p ${DB_PORT} -U postgres -c "\du" | grep ${DB_USER}
\ No newline at end of file
+          echo "Users:"
+          psql -h ${DB_HOST} -p ${DB_PORT} -U postgres -c "\du" | grep -E "${DB_USER}|${DB_READONLY_USER}"