15 lines
967 B
SQL
15 lines
967 B
SQL
-- Idempotent controls not expressible in the installed CNPG managed.roles CRD.
|
|
-- Apply as the controlled apps-pg cluster administrator only after notifying
|
|
-- both consumers of the published limits in docs/s3-consumer-interfaces.md.
|
|
ALTER ROLE vergabe SET statement_timeout = '15s';
|
|
ALTER ROLE vergabe SET idle_in_transaction_session_timeout = '15s';
|
|
ALTER ROLE coulomb_social SET statement_timeout = '15s';
|
|
ALTER ROLE coulomb_social SET idle_in_transaction_session_timeout = '15s';
|
|
|
|
-- PostgreSQL grants CONNECT and TEMPORARY to PUBLIC by default. A database per
|
|
-- consumer is not an isolation boundary until those defaults are removed.
|
|
REVOKE CONNECT, TEMPORARY ON DATABASE apps_meta FROM PUBLIC;
|
|
REVOKE CONNECT, TEMPORARY ON DATABASE vergabe_db FROM PUBLIC;
|
|
REVOKE CONNECT, TEMPORARY ON DATABASE coulomb_social_db FROM PUBLIC;
|
|
GRANT CONNECT, TEMPORARY ON DATABASE vergabe_db TO vergabe;
|
|
GRANT CONNECT, TEMPORARY ON DATABASE coulomb_social_db TO coulomb_social;
|