mirror of
https://origin.cursor.com/mrdevmx/panels.git
synced 2026-10-09 14:33:17 +00:00
b87b0205a8
- Fase 0: scripts de aprovisionamiento (db/provision/) para roles, dos bases de datos separadas (panels_platform / panels_product con esquemas iam+core) y ACLs de Redis por modulo, con verificacion automatizada de aislamiento (verify-isolation.sh) y setup local reproducible (dev-local.sh). - Fase 1: changelogs de Liquibase reescritos para Postgres (db/platform, db/iam, db/core reemplazan db/app + los changesets SQLite de platform). Baseline como estado final (no replay literal), tipos traducidos (IDENTITY, TIMESTAMPTZ/DATE, NUMERIC, BOOLEAN, CITEXT), contexts dev vs. schema/catalogos, RLS por tenant_id como defensa en profundidad, uploaded_by/created_by como snapshot desnormalizado (sin FK hacia iam). - Migraciones ya no corren en el arranque de la API: paso explicito de deploy via db/update.sh con credenciales _owner. Verificado end-to-end contra Postgres 16 + Redis local. Co-authored-by: alberto.martinez <alberto.martinez@mrdev.mx>
62 lines
2.6 KiB
Bash
Executable file
62 lines
2.6 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
# PANELS · Fase 0 · aprovisiona Postgres + Redis LOCALES (dev), reproduciendo
|
|
# la misma topología de roles/esquemas/ACLs que se usará en Coolify.
|
|
#
|
|
# Requiere: un Postgres corriendo en localhost:5432 accesible como `postgres`
|
|
# vía socket unix (auth peer, el default de un `apt install postgresql`), y
|
|
# un Redis en localhost:6379.
|
|
#
|
|
# Uso: ./db/provision/dev-local.sh
|
|
set -euo pipefail
|
|
cd "$(dirname "$0")"
|
|
|
|
PG_SUPERUSER_CMD="sudo -u postgres psql -v ON_ERROR_STOP=1"
|
|
PGHOST=127.0.0.1
|
|
PGPORT=5432
|
|
REDIS_HOST=127.0.0.1
|
|
REDIS_PORT=6379
|
|
|
|
gen_pw() { openssl rand -hex 24; }
|
|
|
|
PLATFORM_OWNER_PW=$(gen_pw); PLATFORM_APP_PW=$(gen_pw)
|
|
IAM_OWNER_PW=$(gen_pw); IAM_APP_PW=$(gen_pw)
|
|
CORE_OWNER_PW=$(gen_pw); CORE_APP_PW=$(gen_pw)
|
|
IAM_REDIS_PW=$(gen_pw); CORE_REDIS_PW=$(gen_pw)
|
|
|
|
echo "== 1/5: roles =="
|
|
$PG_SUPERUSER_CMD \
|
|
-v platform_owner_pw="${PLATFORM_OWNER_PW}" -v platform_app_pw="${PLATFORM_APP_PW}" \
|
|
-v iam_owner_pw="${IAM_OWNER_PW}" -v iam_app_pw="${IAM_APP_PW}" \
|
|
-v core_owner_pw="${CORE_OWNER_PW}" -v core_app_pw="${CORE_APP_PW}" \
|
|
-f 01-roles.sql
|
|
|
|
echo "== 2/5: bases de datos =="
|
|
$PG_SUPERUSER_CMD -f 02-databases.sql
|
|
|
|
echo "== 3/5: privilegios panels_platform =="
|
|
$PG_SUPERUSER_CMD -d panels_platform -f 03-platform-database.sql
|
|
|
|
echo "== 4/5: esquemas + privilegios panels_product =="
|
|
$PG_SUPERUSER_CMD -d panels_product -f 04-product-database.sql
|
|
|
|
echo "== 5/5: Redis ACLs =="
|
|
REDIS_ADMIN_URL="redis://${REDIS_HOST}:${REDIS_PORT}" \
|
|
IAM_REDIS_PASSWORD="$IAM_REDIS_PW" \
|
|
CORE_REDIS_PASSWORD="$CORE_REDIS_PW" \
|
|
./05-redis-acl.sh
|
|
|
|
ENV_FILE="../../.env.dev-local"
|
|
cat > "$ENV_FILE" <<EOF
|
|
# Generado por db/provision/dev-local.sh — solo para desarrollo local. No commitear.
|
|
DATABASE_URL_PLATFORM=postgresql://panels_platform_app:${PLATFORM_APP_PW}@${PGHOST}:${PGPORT}/panels_platform
|
|
DATABASE_URL_PLATFORM_OWNER=postgresql://panels_platform_owner:${PLATFORM_OWNER_PW}@${PGHOST}:${PGPORT}/panels_platform
|
|
DATABASE_URL_IAM=postgresql://panels_iam_app:${IAM_APP_PW}@${PGHOST}:${PGPORT}/panels_product
|
|
DATABASE_URL_IAM_OWNER=postgresql://panels_iam_owner:${IAM_OWNER_PW}@${PGHOST}:${PGPORT}/panels_product
|
|
DATABASE_URL_CORE=postgresql://panels_core_app:${CORE_APP_PW}@${PGHOST}:${PGPORT}/panels_product
|
|
DATABASE_URL_CORE_OWNER=postgresql://panels_core_owner:${CORE_OWNER_PW}@${PGHOST}:${PGPORT}/panels_product
|
|
REDIS_URL_IAM=redis://panels_iam_redis:${IAM_REDIS_PW}@${REDIS_HOST}:${REDIS_PORT}
|
|
REDIS_URL_CORE=redis://panels_core_redis:${CORE_REDIS_PW}@${REDIS_HOST}:${REDIS_PORT}
|
|
EOF
|
|
|
|
echo ""
|
|
echo "Listo. Credenciales de desarrollo local escritas en $(cd "$(dirname "$ENV_FILE")" && pwd)/$(basename "$ENV_FILE")"
|