#!/bin/sh
set -eu

password_file=/run/secrets/grafana_database_password

if [ ! -r "$password_file" ]; then
  echo "Grafana database password file is missing or unreadable" >&2
  exit 1
fi

grafana_password=$(cat "$password_file")

if [ -z "$grafana_password" ]; then
  echo "Grafana database password must not be empty" >&2
  exit 1
fi

psql \
  --set=ON_ERROR_STOP=1 \
  --set=grafana_password="$grafana_password" \
  --username "$POSTGRES_USER" \
  --dbname "$POSTGRES_DB" <<-'EOSQL'
SELECT format('CREATE ROLE grafana LOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE NOINHERIT PASSWORD %L', :'grafana_password')
WHERE NOT EXISTS (SELECT FROM pg_catalog.pg_roles WHERE rolname = 'grafana') \gexec

ALTER ROLE grafana PASSWORD :'grafana_password';

SELECT 'CREATE DATABASE grafana OWNER grafana'
WHERE NOT EXISTS (SELECT FROM pg_catalog.pg_database WHERE datname = 'grafana') \gexec

REVOKE ALL ON DATABASE grafana FROM PUBLIC;
GRANT CONNECT, TEMPORARY ON DATABASE grafana TO grafana;
EOSQL

unset grafana_password