Prepare Kalendartool for MPM and disable invites

docker/postgres/init/01-app-user.sh

@@ -0,0 +1,16 @@
+#!/bin/sh
+set -eu
+
+: "${CALENDAR_DB_PASSWORD:?CALENDAR_DB_PASSWORD must be configured}"
+
+psql -v ON_ERROR_STOP=1 \
+  --username "$POSTGRES_USER" \
+  --dbname "$POSTGRES_DB" \
+  -v calendar_db_password="$CALENDAR_DB_PASSWORD" <<'SQL'
+SELECT format('CREATE ROLE calendar_app LOGIN PASSWORD %L', :'calendar_db_password')
+WHERE NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'calendar_app')
+\gexec
+
+GRANT CONNECT ON DATABASE calendar TO calendar_app;
+GRANT USAGE, CREATE ON SCHEMA public TO calendar_app;
+SQL

docker/postgres/init/01-app-user.sql

@@ -1,26 +0,0 @@
--- Least-Privilege-DB-User fuer die App (wird nur bei INITIALISIERUNG
--- eines leeren pgdata-Volumes automatisch ausgefuehrt).
---
--- Bei BESTEHENDem Volume den User einmalig manuell anlegen:
---   docker compose exec db psql -U calendar -d calendar -f - <<'SQL'
---     ... (Inhalt dieses Scripts)
---   SQL
---
--- Der App-User darf nur in seiner Datenbank arbeiten und besitzt
--- keine Superuser-Rechte (im Gegensatz zum Owner "calendar").
-
-DO $$
-BEGIN
-  IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'calendar_app') THEN
-    CREATE ROLE calendar_app LOGIN PASSWORD 'calendar_app';
-  END IF;
-END
-$$;
-
-GRANT CONNECT ON DATABASE calendar TO calendar_app;
-GRANT USAGE ON SCHEMA public TO calendar_app;
-GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO calendar_app;
-ALTER DEFAULT PRIVILEGES IN SCHEMA public
-  GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO calendar_app;
-GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA public TO calendar_app;
-GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA public TO calendar_app;