Read only DB role for grafana

db/migrations/000006_create_readonly_user.down.sql

@@ -0,0 +1,5 @@
+DROP USER read_user;
+REVOKE CONNECT ON DATABASE db FROM readonly;
+REVOKE USAGE ON SCHEMA public FROM readonly;
+REVOKE SELECT ON ALL TABLES IN SCHEMA public FROM readonly;
+DROP ROLE readonly;

db/migrations/000006_create_readonly_user.up.sql

@@ -0,0 +1,7 @@
+CREATE ROLE readonly;
+GRANT CONNECT ON DATABASE db TO readonly;
+GRANT USAGE ON SCHEMA public TO readonly;
+GRANT SELECT ON ALL TABLES IN SCHEMA public TO readonly;
+
+CREATE USER read_user WITH PASSWORD 'read_user_pass';
+GRANT readonly TO read_user;

docker-compose.dev.yml

@@ -26,8 +26,8 @@ services:
       - grafana-storage:/var/lib/grafana
     environment:
       PG_HOST: 'postgres:5432'
-      PG_USER: 'postgres'
-      PG_PASSWORD: 'pass'
+      PG_USER: 'read_user'
+      PG_PASSWORD: 'read_user_pass'
       PG_DB: 'db'
       PROM_USER: 'admin'
       PROM_HOST: 'http://prometheus:9090'

docker-compose.prod.yml

@@ -42,8 +42,8 @@ services:
       - grafana-storage:/var/lib/grafana
     environment:
       PG_HOST: 'postgres:5432'
-      PG_USER: 'postgres'
-      PG_PASSWORD: 'pass'
+      PG_USER: 'read_user'
+      PG_PASSWORD: 'read_user_pass'
       PG_DB: 'db'
       PROM_USER: 'admin'
       PROM_HOST: 'http://prometheus:9090'