benvin/grafana_postgres (#334)

Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/334

site/profiles/manifests/sql/postgresdb.pp

@@ -4,8 +4,8 @@ class profiles::sql::postgresdb (
   String  $dbpass,
   String  $cluster_name,
   Boolean $create_host_users = false,
-  Boolean $members_lookup    = false,
-  String  $members_role      = undef,
+  Boolean $members_lookup    = true,
+  String  $members_role      = $facts['enc_role'],
   Array   $servers           = [],
 ){
 
@@ -33,6 +33,7 @@ class profiles::sql::postgresdb (
     # manage the postgres db
     @@profiles::sql::postgres::db { "${facts['networking']['fqdn']}_db_${dbname}":
       dbname => $dbname,
+      owner  => $dbuser,
       tag    => $tag,
     }
 
@@ -42,21 +43,25 @@ class profiles::sql::postgresdb (
       tag      => $tag,
     }
 
-    @@profiles::sql::postgres::grant { "${facts['networking']['fqdn']}_grant_db_${dbuser}_${dbuser}}":
-      dbname    => $dbname,
-      username  => $dbuser,
-      type      => 'DATABASE',
-      privilege => 'ALL PRIVILEGES',
-      tag       => $tag,
+    ['CONNECT', 'CREATE', 'TEMPORARY'].each |$priv| {
+      @@profiles::sql::postgres::grant { "${facts['networking']['fqdn']}_grant_db_${dbname}_${dbuser}_${priv}":
+        dbname    => $dbname,
+        username  => $dbuser,
+        type      => 'DATABASE',
+        privilege => $priv,
+        tag       => $tag,
+      }
     }
 
-    @@profiles::sql::postgres::grant { "${facts['networking']['fqdn']}_grant_schema_${dbuser}_${dbuser}}":
-      dbname    => $dbname,
-      username  => $dbuser,
-      type      => 'SCHEMA',
-      schema    => 'public',
-      privilege => 'ALL PRIVILEGES',
-      tag       => $tag,
-    }
+    #['USAGE', 'CREATE'].each |$priv| {
+    #  @@profiles::sql::postgres::grant { "${facts['networking']['fqdn']}_grant_schema_${dbname}_${dbuser}_${priv}":
+    #    dbname    => $dbname,
+    #    username  => $dbuser,
+    #    type      => 'SCHEMA',
+    #    schema    => 'public',
+    #    privilege => $priv,
+    #    tag       => $tag,
+    #  }
+    #}
   }
 }