-- The application and migration role must not be the PostgreSQL superuser.
-- Runs only when PostgreSQL initializes a fresh named volume.
\getenv app_password NORDEN_APP_PASSWORD
SELECT format('CREATE ROLE norden_app LOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE PASSWORD %L', :'app_password') \gexec
ALTER DATABASE norden OWNER TO norden_app;
\connect norden
ALTER SCHEMA public OWNER TO norden_app;
REVOKE CREATE ON SCHEMA public FROM PUBLIC;