eec087ac50
Gitea was configured to connect as a 'gitea' DB user that never existed, so it sat unconfigured behind a working tunnel. It now gets its OWN role and database via a first-init script — I-1 says we never write Gitea's tables, and that is better as a permission than as a promise. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
15 lines
679 B
Bash
Executable File
15 lines
679 B
Bash
Executable File
#!/bin/bash
|
|
# Gitea gets its OWN role and database, not ours.
|
|
#
|
|
# I-1: Gitea is a component whose private state we never write to directly. That
|
|
# boundary is worth enforcing at the database, not just in prose — our plane
|
|
# holds schema `windgit` in `windygit`, and Gitea holds a database it alone can
|
|
# reach. A shared login would make "we never write Gitea's tables" a promise
|
|
# instead of a permission.
|
|
set -e
|
|
psql -v ON_ERROR_STOP=1 --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" <<-SQL
|
|
CREATE ROLE gitea LOGIN PASSWORD '${GITEA_DB_PASSWORD:?GITEA_DB_PASSWORD must be set}';
|
|
CREATE DATABASE gitea OWNER gitea;
|
|
REVOKE ALL ON DATABASE gitea FROM PUBLIC;
|
|
SQL
|