postgres-provisioner

Everything a PostgreSQL database needs before your app connects — down to privileges, migrations and publications.

v2.0.0 · latest
MIT
Go
single static binary in a scratch image

docker pull ghcr.io/datarocks-ag/postgres-provisioner:2.0.0

What it does

Idempotent — Run it on every deploy. Existing resources are reconciled, not recreated.
Additive and safe — Never drops roles, databases, schemas, tables or grants that aren't in the config. Privileges are removed only through explicit revokes.
Secret-friendly — ${VAR} references and *_FILE secrets (Docker, Kubernetes); passwords are redacted from every log line.
Previewable — --dry-run logs every statement it would execute.
Small — A single static binary in a scratch image.

config.example.yaml

roles:
  - name: "app_user"
    password: "${APP_DB_PASSWORD}"     # resolved from environment
    options:
      login: true
      superuser: false
      createdb: false
      createrole: false
      inherit: true                    # inherit privileges of granted roles
      replication: false               # allow logical/physical replication
      bypassrls: false                 # bypass row-level security policies
      connection_limit: -1             # unlimited
      valid_until: "2030-01-01"        # password expiry (omit for no expiry)
    settings:                          # ALTER ROLE ... SET (session defaults)
      statement_timeout: "30s"
      search_path: ["app", "public"]   # list settings as YAML lists
      # work_mem: null                 # null = RESET; omitting a key leaves it unchanged

  - name: "readonly_user"
    password: "${READONLY_DB_PASSWORD}"
    options:
      login: true

  # Read-only monitoring account for postgres_exporter (Prometheus).
  # member_of grants membership in other roles; predefined roles like pg_monitor
  # (read all stats/settings, no table data access) need not be declared above.
  - name: "postgres_exporter"
    password: "${POSTGRES_EXPORTER_PASSWORD}"
    member_of: ["pg_monitor"]
    options:
      login: true
      connection_limit: 5

databases:
  - name: "myapp"
    owner: "app_user"
    settings:                          # ALTER DATABASE ... SET
      TimeZone: "UTC"
    role_settings:                     # ALTER ROLE ... IN DATABASE myapp SET
      readonly_user:

Excerpt from config.example.yaml

Full documentation, configuration reference and how-tos.

Read the docs →

More provisioners

keycloak-provisionerrealms, clients, protocol mappers, roles, users nats-provisionerstreams, consumers redpanda-provisionertopics, schemas, SASL users, ACLs gcp-emulator-provisionerPub/Sub topics, subscriptions, Cloud Storage buckets seaweedfs-provisionerS3 buckets, IAM identities, bucket policies, lifecycle rules

Data Rocks AG

[ONE OR TWO LINES ON WHAT DATA ROCKS DOES AND FOR WHOM]

Visit datarocks.ch →