67 lines
3.5 KiB
YAML
67 lines
3.5 KiB
YAML
|
|
name: Setup PostgreSQL Database
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
setup-database:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Install PostgreSQL client
|
|
run: |
|
|
sudo apt-get update
|
|
sudo apt-get install -y postgresql-client
|
|
|
|
- name: Create database and users (idempotent)
|
|
env:
|
|
DB_HOST: ${{ secrets.POSTGRES_HOST }}
|
|
DB_PORT: ${{ secrets.POSTGRES_PORT }}
|
|
PGPASSWORD: ${{ secrets.POSTGRES_ROOT_PASSWORD }}
|
|
DB_NAME: ${{ secrets.DB_NAME }}
|
|
DB_USER: ${{ secrets.DB_USER }}
|
|
DB_PASSWORD: ${{ secrets.DB_PASSWORD }}
|
|
DB_READONLY_USER: ${{ secrets.DB_READONLY_USER }}
|
|
DB_READONLY_PASSWORD: ${{ secrets.DB_READONLY_PASSWORD }}
|
|
run: |
|
|
# Create database if it doesn't exist
|
|
psql -h ${DB_HOST} -p ${DB_PORT} -U postgres -tc "SELECT 1 FROM pg_database WHERE datname = '${DB_NAME}'" | grep -q 1 || \
|
|
psql -h ${DB_HOST} -p ${DB_PORT} -U postgres -c "CREATE DATABASE ${DB_NAME};"
|
|
|
|
# Create admin user if it doesn't exist
|
|
psql -h ${DB_HOST} -p ${DB_PORT} -U postgres -tc "SELECT 1 FROM pg_user WHERE usename = '${DB_USER}'" | grep -q 1 || \
|
|
psql -h ${DB_HOST} -p ${DB_PORT} -U postgres -c "CREATE USER ${DB_USER} WITH PASSWORD '${DB_PASSWORD}';"
|
|
|
|
# Grant all privileges on database to admin user
|
|
psql -h ${DB_HOST} -p ${DB_PORT} -U postgres -c "GRANT ALL PRIVILEGES ON DATABASE ${DB_NAME} TO ${DB_USER};"
|
|
|
|
# Grant schema privileges to admin user
|
|
psql -h ${DB_HOST} -p ${DB_PORT} -U postgres -d ${DB_NAME} -c "GRANT ALL PRIVILEGES ON SCHEMA public TO ${DB_USER};"
|
|
psql -h ${DB_HOST} -p ${DB_PORT} -U postgres -d ${DB_NAME} -c "GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA public TO ${DB_USER};"
|
|
psql -h ${DB_HOST} -p ${DB_PORT} -U postgres -d ${DB_NAME} -c "ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL PRIVILEGES ON TABLES TO ${DB_USER};"
|
|
|
|
# Create read-only user if it doesn't exist
|
|
psql -h ${DB_HOST} -p ${DB_PORT} -U postgres -tc "SELECT 1 FROM pg_user WHERE usename = '${DB_READONLY_USER}'" | grep -q 1 || \
|
|
psql -h ${DB_HOST} -p ${DB_PORT} -U postgres -c "CREATE USER ${DB_READONLY_USER} WITH PASSWORD '${DB_READONLY_PASSWORD}';"
|
|
|
|
# Grant read-only privileges to readonly user
|
|
psql -h ${DB_HOST} -p ${DB_PORT} -U postgres -c "GRANT CONNECT ON DATABASE ${DB_NAME} TO ${DB_READONLY_USER};"
|
|
psql -h ${DB_HOST} -p ${DB_PORT} -U postgres -d ${DB_NAME} -c "GRANT USAGE ON SCHEMA public TO ${DB_READONLY_USER};"
|
|
psql -h ${DB_HOST} -p ${DB_PORT} -U postgres -d ${DB_NAME} -c "GRANT SELECT ON ALL TABLES IN SCHEMA public TO ${DB_READONLY_USER};"
|
|
psql -h ${DB_HOST} -p ${DB_PORT} -U postgres -d ${DB_NAME} -c "ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT ON TABLES TO ${DB_READONLY_USER};"
|
|
|
|
- name: Verify setup
|
|
env:
|
|
DB_HOST: ${{ secrets.POSTGRES_HOST }}
|
|
DB_PORT: ${{ secrets.POSTGRES_PORT }}
|
|
PGPASSWORD: ${{ secrets.POSTGRES_ROOT_PASSWORD }}
|
|
DB_NAME: ${{ secrets.DB_NAME }}
|
|
DB_USER: ${{ secrets.DB_USER }}
|
|
DB_READONLY_USER: ${{ secrets.DB_READONLY_USER }}
|
|
run: |
|
|
echo "Database setup completed successfully!"
|
|
echo "Database:"
|
|
psql -h ${DB_HOST} -p ${DB_PORT} -U postgres -c "\l" | grep ${DB_NAME}
|
|
echo "Users:"
|
|
psql -h ${DB_HOST} -p ${DB_PORT} -U postgres -c "\du" | grep -E "${DB_USER}|${DB_READONLY_USER}"
|