postgres: create a database with an owner already set #57
Conversation
In the current setup databases are owned by the admin role `postgres`, and we separately grant users the permission to create their own tables in the schema `public`. I believe our intention was to make users owners of the corresponding databases, effectively granting them all permissions w/o any extra steps. This will make the tests and new databases consistent with our production instance where the database is owned by role `xsnippet-api`.
| - name: Setup postgresql users | ||
| community.postgresql.postgresql_user: | ||
| db: "{{ item.database }}" |
There was a problem hiding this comment.
This was useless, as the option controls which database to connect to, and not which database to grant permissions on. We connect as admin role postgres to database postgres, and that is sufficient to create user roles and databases.
| @@ -42,28 +42,17 @@ | |||
| enabled: true | |||
| become: true | |||
|
|
|||
| - name: Setup postgresql databases | |||
There was a problem hiding this comment.
This has to be executed after we create a user, or otherwise setting a database owner will fail due to non-existent role.
| user: "{{ item.username }}" | ||
| with_items: "{{ postgres_users }}" | ||
| become: true | ||
| become_user: postgres | ||
|
|
||
| - name: Grant users permissions to create tables in the schema `public` |
There was a problem hiding this comment.
I now think that my fix in 3ccb652 was wrong an I misunderstood what changed in PostgreSQL 15. The database owner will have the necessary permissions on the schema public, and no additional grants are needed (https://www.enterprisedb.com/blog/new-public-schema-permissions-postgresql-15).
In the current setup databases are owned by the admin role
postgres, and we separately grant users the permission to create their own tables in the schemapublic. I believe our intention was to make users the owners of the corresponding databases, effectively granting them all permissions w/o any extra steps.This will make the tests and new databases consistent with our production instance where the database is owned by role
xsnippet-api.