feat(nomad): auto-provision app db user

job.nomad.hcl

@@ -23,6 +23,87 @@ job "garbage_speak" {
       }
     }
 
+    task "db-init" {
+      driver = "podman"
+      user   = "root"
+
+      lifecycle {
+        hook    = "prestart"
+        sidecar = false
+      }
+
+      config {
+        image        = "docker.io/postgres:17"
+        command      = "/bin/sh"
+        args         = ["${NOMAD_TASK_DIR}/provision.sh"]
+        network_mode = "host"
+      }
+
+      template {
+        destination = "${NOMAD_SECRETS_DIR}/env.vars"
+        env         = true
+        data        = <<EOF
+{{ with nomadVar "nomad/jobs" -}}
+PGHOST={{ .postgres_host }}
+PGPORT={{ .postgres_port }}
+PGUSER={{ .postgres_user }}
+PGPASSWORD={{ .postgres_password }}
+PGSSLMODE=require
+{{- end }}
+{{ with nomadVar "nomad/jobs/garbage_speak" -}}
+POSTGRES_APP_PASSWORD={{ .db_password }}
+{{- end }}
+EOF
+      }
+
+      template {
+        destination = "${NOMAD_TASK_DIR}/provision.sh"
+        perms       = "755"
+        data        = <<EOF
+#!/bin/sh
+set -eu
+
+DB_NAME="{{ env "NOMAD_JOB_NAME" }}"
+ROLE_NAME="{{ env "NOMAD_JOB_NAME" | replaceAll "-" "_" }}_app"
+
+psql -d defaultdb <<'SQL'
+  SELECT 'CREATE DATABASE garbage_speak
+    ENCODING ''UTF8''
+    LC_COLLATE ''C''
+    LC_CTYPE ''C''
+    TEMPLATE template0'
+  WHERE NOT EXISTS (SELECT FROM pg_database WHERE datname = 'garbage_speak')\gexec
+SQL
+
+psql -d defaultdb \
+  -c "DO \$\$
+      BEGIN
+        IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = '$ROLE_NAME') THEN
+          CREATE ROLE $ROLE_NAME WITH LOGIN PASSWORD '${POSTGRES_APP_PASSWORD}';
+        ELSE
+          ALTER ROLE $ROLE_NAME WITH PASSWORD '${POSTGRES_APP_PASSWORD}';
+        END IF;
+      END
+      \$\$;
+      GRANT ALL PRIVILEGES ON DATABASE $DB_NAME TO $ROLE_NAME;"
+
+psql -d "$DB_NAME" -c "GRANT ALL ON SCHEMA public TO $ROLE_NAME;" \
+  || psql -d "$DB_NAME" -c "SET ROLE pg_database_owner; GRANT ALL ON SCHEMA public TO $ROLE_NAME; RESET ROLE;" \
+  || true
+
+psql -d "$DB_NAME" \
+  -c "REASSIGN OWNED BY $PGUSER TO $ROLE_NAME;
+      ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON TABLES TO $ROLE_NAME;
+      ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON SEQUENCES TO $ROLE_NAME;"
+EOF
+      }
+
+      resources {
+        cpu    = 128
+        memory = 128
+      }
+    }
+
     task "garbage_speak" {
       driver = "exec"
 
@@ -42,8 +123,9 @@ job "garbage_speak" {
 
       template {
         data        = <<EOF
-{{ with nomadVar "nomad/jobs" }}
-POSTGRES_URL=postgresql://{{ .postgres_user }}:{{ .postgres_password }}@{{ .postgres_host }}:{{ .postgres_port }}/garbage_speak?sslmode=require{{ end }}
+{{ with nomadVar "nomad/jobs" -}}
+POSTGRES_URL=postgresql://{{ env "NOMAD_JOB_NAME" | replaceAll "-" "_" }}_app:{{ with nomadVar "nomad/jobs/garbage_speak" }}{{ .db_password }}{{ end }}@{{ .postgres_host }}:{{ .postgres_port }}/{{ env "NOMAD_JOB_NAME" }}?sslmode=require
+{{- end }}
 {{ with nomadVar "nomad/jobs/garbage_speak" }}SMTP_PASSWORD={{ .SMTP_PASSWORD }}{{ end }}
 EOF
         destination = "local/env"