read only user

docker-entrypoint-initdb-core.d/1.1.0_02_master_create_ro_user.sh

@@ -7,19 +7,30 @@ then
 fi
 
 psql <<-EOF
-  CREATE USER "${POSTGRES_RO_USER}"
-    NOSUPERUSER
-    NOCREATEDB
-    NOCREATEROLE
-    LOGIN
-    ENCRYPTED PASSWORD '${POSTGRES_RO_PASSWORD}';
+CREATE USER ${POSTGRES_RO_USER} WITH ENCRYPTED PASSWORD '${POSTGRES_RO_PASSWORD}';-- NOINHERIT;
 
-  REVOKE ALL ON DATABASE ${POSTGRES_DB} FROM ${POSTGRES_RO_USER};
-  GRANT CONNECT ON DATABASE ${POSTGRES_DB} TO ${POSTGRES_RO_USER};
+\c ${POSTGRES_DB}
 
-  REVOKE ALL ON SCHEMA public FROM ${POSTGRES_RO_USER};
-  GRANT USAGE ON SCHEMA public TO ${POSTGRES_RO_USER};
+REVOKE ALL ON DATABASE ${POSTGRES_DB} FROM ${POSTGRES_RO_USER};
+GRANT CONNECT ON DATABASE ${POSTGRES_DB} TO ${POSTGRES_RO_USER};
+
+REVOKE ALL ON SCHEMA public FROM ${POSTGRES_RO_USER};
+REVOKE CREATE ON SCHEMA public FROM ${POSTGRES_RO_USER};
+GRANT USAGE ON SCHEMA public TO ${POSTGRES_RO_USER};
+
+REVOKE ALL ON ALL TABLES IN SCHEMA public FROM ${POSTGRES_RO_USER};
+GRANT SELECT ON ALL TABLES IN SCHEMA public TO ${POSTGRES_RO_USER};
+ALTER DEFAULT PRIVILEGES IN SCHEMA public REVOKE ALL ON TABLES FROM ${POSTGRES_RO_USER};
+ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT ON TABLES TO ${POSTGRES_RO_USER};
+
+REVOKE ALL ON ALL SEQUENCES IN SCHEMA public FROM ${POSTGRES_RO_USER};
+GRANT USAGE ON ALL SEQUENCES IN SCHEMA public TO ${POSTGRES_RO_USER};
+ALTER DEFAULT PRIVILEGES IN SCHEMA public REVOKE ALL ON SEQUENCES FROM ${POSTGRES_RO_USER};
+ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT USAGE ON SEQUENCES TO ${POSTGRES_RO_USER};
+
+REVOKE ALL ON ALL FUNCTIONS IN SCHEMA public FROM ${POSTGRES_RO_USER};
+GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA public TO ${POSTGRES_RO_USER};
+ALTER DEFAULT PRIVILEGES IN SCHEMA public REVOKE ALL ON FUNCTIONS FROM ${POSTGRES_RO_USER};
+ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT EXECUTE ON FUNCTIONS TO ${POSTGRES_RO_USER};
 
-  GRANT SELECT ON ALL TABLES IN SCHEMA public TO ${POSTGRES_RO_USER};
-  ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT ON TABLES TO ${POSTGRES_RO_USER};
 EOF