Hartmut
19aeb2ba04
CI / Lint (push) Successful in 3m4s
CI / Typecheck (push) Successful in 3m6s
CI / Architecture Guardrails (push) Successful in 3m8s
CI / Assistant Split Regression (push) Successful in 3m48s
CI / Build (push) Has been cancelled
CI / E2E Tests (push) Has been cancelled
CI / Fresh-Linux Docker Deploy (push) Has been cancelled
CI / Release Images (push) Has been cancelled
CI / Unit Tests (push) Has been cancelled
rename(phase 3): compose/DB/infra + stray code refs capakraken → nexus (#62) Co-authored-by: Hartmut Nörenberg <hn@hartmut-noerenberg.com> Co-committed-by: Hartmut Nörenberg <hn@hartmut-noerenberg.com>
24 lines
941 B
Bash
Executable File
24 lines
941 B
Bash
Executable File
#!/usr/bin/env bash
|
|
# Remove SUPERUSER from the application database user
|
|
# Run after initial setup: bash scripts/harden-postgres.sh
|
|
|
|
DB_USER="${DB_USER:-nexus}"
|
|
DB_NAME="${DB_NAME:-nexus}"
|
|
|
|
echo "Hardening PostgreSQL for $DB_USER..."
|
|
|
|
# Remove SUPERUSER privilege
|
|
docker compose exec -T postgres psql -U postgres -c "ALTER USER $DB_USER NOSUPERUSER;"
|
|
|
|
# Grant only needed permissions
|
|
docker compose exec -T postgres psql -U postgres -d $DB_NAME -c "
|
|
GRANT CONNECT ON DATABASE $DB_NAME TO $DB_USER;
|
|
GRANT USAGE ON SCHEMA public TO $DB_USER;
|
|
GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO $DB_USER;
|
|
GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA public TO $DB_USER;
|
|
ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO $DB_USER;
|
|
ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT USAGE, SELECT ON SEQUENCES TO $DB_USER;
|
|
"
|
|
|
|
echo "Done. $DB_USER no longer has SUPERUSER."
|