phase2: 4 DB roles (crm_migration/api/worker/auth) + docker-compose updated + GRANT USAGE + RLS verified with unprivileged role

2026-07-29 16:49:09 +02:00
parent 8da803156e
commit 840795b5b9
2 changed files with 110 additions and 3 deletions
@@ -76,10 +76,10 @@ services:
      redis:
        condition: service_healthy
    environment:
-      # App/worker uses crm_runtime (NOSUPERUSER, NOBYPASSRLS) — RLS enforced
+      # App/worker uses crm_api (NOSUPERUSER, NOBYPASSRLS) — RLS enforced
      DATABASE_URL: ${DATABASE_URL:?DATABASE_URL is required}
-      # Migration/DDL uses crm_user (owner, can bypass RLS for DDL)
-      MIGRATION_DATABASE_URL: ${MIGRATION_DATABASE_URL:-postgresql+asyncpg://${POSTGRES_USER:-crm_user}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB:-crm_db}}
+      # Migration/DDL uses crm_migration (owner, can bypass RLS for DDL)
+      MIGRATION_DATABASE_URL: ${MIGRATION_DATABASE_URL:-postgresql+asyncpg://crm_migration:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB:-crm_db}}
      REDIS_URL: ${REDIS_URL:-redis://:${REDIS_PASSWORD}@redis:6379/0}
      SECRET_KEY: ${SECRET_KEY:?SECRET_KEY is required (min 32 chars)}
      CORS_ORIGINS: ${CORS_ORIGINS:-http://localhost:8000,http://localhost:5173}