37 lines
1011 B
Bash
37 lines
1011 B
Bash
#!/bin/sh
|
|
set -eu
|
|
|
|
password_file=/run/secrets/grafana_database_password
|
|
|
|
if [ ! -r "$password_file" ]; then
|
|
echo "Grafana database password file is missing or unreadable" >&2
|
|
exit 1
|
|
fi
|
|
|
|
grafana_password=$(cat "$password_file")
|
|
|
|
if [ -z "$grafana_password" ]; then
|
|
echo "Grafana database password must not be empty" >&2
|
|
exit 1
|
|
fi
|
|
|
|
psql \
|
|
--set=ON_ERROR_STOP=1 \
|
|
--set=grafana_password="$grafana_password" \
|
|
--username "$POSTGRES_USER" \
|
|
--dbname "$POSTGRES_DB" <<-'EOSQL'
|
|
SELECT format('CREATE ROLE grafana LOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE NOINHERIT PASSWORD %L', :'grafana_password')
|
|
WHERE NOT EXISTS (SELECT FROM pg_catalog.pg_roles WHERE rolname = 'grafana') \gexec
|
|
|
|
ALTER ROLE grafana PASSWORD :'grafana_password';
|
|
|
|
SELECT 'CREATE DATABASE grafana OWNER grafana'
|
|
WHERE NOT EXISTS (SELECT FROM pg_catalog.pg_database WHERE datname = 'grafana') \gexec
|
|
|
|
REVOKE ALL ON DATABASE grafana FROM PUBLIC;
|
|
GRANT CONNECT, TEMPORARY ON DATABASE grafana TO grafana;
|
|
EOSQL
|
|
|
|
unset grafana_password
|
|
|