Badges: use a specific user to connect to the datanommer DB

Signed-off-by: Aurélien Bompard <aurelien@bompard.org>

inventory/inventory

@@ -190,6 +190,12 @@ db-datanommer01.stg.iad2.fedoraproject.org
 db-koji01.stg.iad2.fedoraproject.org
 #copr-db-stg.aws.fedoraproject.org
 
+[datanommer_dbserver]
+db-datanommer02.iad2.fedoraproject.org
+
+[datanommer_dbserver_stg]
+db-datanommer01.stg.iad2.fedoraproject.org
+
 # clients that talk to the main postgres servers
 [postgres_clients]
 

playbooks/openshift-apps/badges.yml

@@ -25,6 +25,29 @@
         owner: "{{ tahrirDBUser }}"
         encoding: UTF-8
 
+- name: give access to the datanommer DB
+  hosts: datanommer_dbserver:datanommer_dbserver_stg
+  gather_facts: no
+  become: yes
+  become_user: postgres
+  vars_files:
+    - /srv/web/infra/ansible/vars/global.yml
+    - /srv/private/ansible/vars.yml
+    - /srv/web/infra/ansible/vars/{{ ansible_distribution }}.yml
+    - /srv/web/infra/ansible/vars/apps/badges.yml
+
+  tasks:
+    - name: DB user
+      postgresql_user:
+        name: "{{ tahrirDBUser }}"
+        password: "{{ (env == 'production')|ternary(tahrirDBPassword, tahrirstgDBPassword) }}"
+    - name: grant the db user read only access to datanommer2
+      postgresql_privs:
+        database: datanommer2
+        privs: SELECT
+        objs: ALL_IN_SCHEMA
+        roles: "{{ tahrirDBUser }}"
+
 - name: make the app be real
   hosts: os_control_stg:os_control
   user: root

roles/openshift-apps/badges/templates/fm-fedbadges.toml

@@ -58,7 +58,7 @@ consume_delay = 1
 database_uri = "postgresql://{{ tahrirDBUser }}:{{ (env == 'production')|ternary(tahrirDBPassword, tahrirstgDBPassword) }}@{{ badges_db_host }}/{{ badges_db_name }}"
 
 # Datanommer database URI
-datanommer_db_uri = "postgresql://{{ datanommerDBUser }}:{{ (env == 'production')|ternary(datanommerDBPassword, datanommer_stg_db_password) }}@db-datanommer{{ (env == 'production')|ternary('02', '01') }}{{ env_suffix }}/datanommer2"
+datanommer_db_uri = "postgresql://{{ tahrirDBUser }}:{{ (env == 'production')|ternary(tahrirDBPassword, tahrirstgDBPassword) }}@db-datanommer{{ (env == 'production')|ternary('02', '01') }}{{ env_suffix }}/datanommer2"
 datagrepper_url = "https://apps{{ env_suffix }}.fedoraproject.org/datagrepper"
 distgit_hostname = "src{{ env_suffix }}.fedoraproject.org"
 id_provider_hostname = "id{{ env_suffix }}.fedoraproject.org"