mirror of
https://github.com/dartdavros/chatballs.git
synced 2026-10-05 09:14:58 +03:00
AndreyandClaude Fable 5.1
1a61780dec
- каталог code/custocrm → code/chatballs; CLI custocrm → chatballs; пакеты hub_platform → chatballs, hub_backend → chatballs_backend (app labels прежние) - переменные CUS_* и CUSTOCRM_* → CHATBALLS_*; образы chatballs-*; compose-проект и база chatballs (были edevs_hub); роли Postgres chatballs_* (были custocrm_*); схема RLS chatballs и GUC chatballs.organization_id; cookie chatballs_* - CI: APP_DIR code/chatballs, DEPLOY_ROOT /opt/chatballs - deploy/migrate/rename-to-chatballs.sh — миграция существующей установки без потери данных: остановка старого проекта, .env (с резервной копией), переименование суперпользователя initdb через временную роль, остальных ролей, базы, схемы и функции RLS; проверено на локальном стеке - dev-стек хранит Postgres в bind-mount data/postgres, как prod (именованный том compose.dev был устаревшим снимком и вводил в заблуждение) - снятие демо удаляет объекты, созданные поверх демо-данных тестировавшим (звонки по демо-диалогу), вместо падения на PROTECT - реальные домены *.custocrm.ru и идентификаторы документов не тронуты Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
52 lines
2.9 KiB
Bash
52 lines
2.9 KiB
Bash
#!/bin/sh
|
|
set -eu
|
|
|
|
: "${POSTGRES_APP_USER:?POSTGRES_APP_USER is required}"
|
|
: "${POSTGRES_APP_PASSWORD:?POSTGRES_APP_PASSWORD is required}"
|
|
: "${POSTGRES_PLATFORM_USER:?POSTGRES_PLATFORM_USER is required}"
|
|
: "${POSTGRES_PLATFORM_PASSWORD:?POSTGRES_PLATFORM_PASSWORD is required}"
|
|
: "${POSTGRES_MIGRATION_USER:?POSTGRES_MIGRATION_USER is required}"
|
|
: "${POSTGRES_MIGRATION_PASSWORD:?POSTGRES_MIGRATION_PASSWORD is required}"
|
|
|
|
psql --set=ON_ERROR_STOP=1 --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" \
|
|
--set=app_user="$POSTGRES_APP_USER" \
|
|
--set=app_password="$POSTGRES_APP_PASSWORD" \
|
|
--set=platform_user="$POSTGRES_PLATFORM_USER" \
|
|
--set=platform_password="$POSTGRES_PLATFORM_PASSWORD" \
|
|
--set=migration_user="$POSTGRES_MIGRATION_USER" \
|
|
--set=migration_password="$POSTGRES_MIGRATION_PASSWORD" <<'SQL'
|
|
CREATE EXTENSION IF NOT EXISTS vector;
|
|
|
|
SELECT 'CREATE ROLE chatballs_runtime_app NOLOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE NOBYPASSRLS'
|
|
WHERE NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'chatballs_runtime_app')
|
|
\gexec
|
|
SELECT 'CREATE ROLE chatballs_runtime_platform NOLOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE NOBYPASSRLS'
|
|
WHERE NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'chatballs_runtime_platform')
|
|
\gexec
|
|
SELECT 'CREATE ROLE chatballs_schema NOLOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE NOBYPASSRLS'
|
|
WHERE NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'chatballs_schema')
|
|
\gexec
|
|
|
|
SELECT format('CREATE ROLE %I LOGIN PASSWORD %L NOSUPERUSER NOCREATEDB NOCREATEROLE NOBYPASSRLS', :'app_user', :'app_password')
|
|
WHERE NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = :'app_user')
|
|
\gexec
|
|
SELECT format('CREATE ROLE %I LOGIN PASSWORD %L NOSUPERUSER NOCREATEDB NOCREATEROLE NOBYPASSRLS', :'platform_user', :'platform_password')
|
|
WHERE NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = :'platform_user')
|
|
\gexec
|
|
SELECT format('CREATE ROLE %I LOGIN PASSWORD %L NOSUPERUSER NOCREATEDB NOCREATEROLE NOBYPASSRLS', :'migration_user', :'migration_password')
|
|
WHERE NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = :'migration_user')
|
|
\gexec
|
|
|
|
SELECT format('GRANT chatballs_runtime_app TO %I', :'app_user') \gexec
|
|
SELECT format('GRANT chatballs_runtime_platform TO %I', :'platform_user') \gexec
|
|
SELECT format('GRANT chatballs_schema TO %I', :'migration_user') \gexec
|
|
-- Runtime roles must not inherit the permissive chatballs_schema_access policy:
|
|
-- membership in the schema-owner role would bypass tenant RLS entirely.
|
|
REVOKE chatballs_schema FROM chatballs_runtime_app, chatballs_runtime_platform;
|
|
SELECT format('GRANT CONNECT ON DATABASE %I TO %I', current_database(), :'app_user') \gexec
|
|
SELECT format('GRANT CONNECT ON DATABASE %I TO %I', current_database(), :'platform_user') \gexec
|
|
SELECT format('GRANT CONNECT, CREATE, TEMPORARY ON DATABASE %I TO %I', current_database(), :'migration_user') \gexec
|
|
SELECT format('GRANT USAGE, CREATE ON SCHEMA public TO %I', :'migration_user') \gexec
|
|
GRANT USAGE, CREATE ON SCHEMA public TO chatballs_schema;
|
|
SQL
|