Configure the timescaledb image with our grafanareader user by default

docker-compose.yaml

@@ -30,7 +30,8 @@ services:
       - grafana:/var/lib/grafana
 
   timescaledb:
-    image: timescale/timescaledb-ha:pg14-latest
+    build:
+      dockerfile: timescaledb/Dockerfile
     environment:
       POSTGRES_DB: metrics
       POSTGRES_PASSWORD: pass

timescaledb/Dockerfile

@@ -0,0 +1,3 @@
+FROM timescale/timescaledb:pg14-latest@sha256:c453fa2d290d578a5983b5823e9ffbf16f478735d8c121620436c4a9c6e55df5
+
+COPY timescaledb/init.sql /docker-entrypoint-initdb.d/

timescaledb/init.sql

@@ -0,0 +1,6 @@
+-- set up the grafanareader role with select permissions by default
+CREATE ROLE grafanareader;
+ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT ON TABLES TO grafanareader;
+ALTER USER grafanareader WITH PASSWORD 'grafana';
+GRANT CONNECT ON DATABASE metrics TO grafanareader;
+GRANT USAGE ON SCHEMA public TO grafanareader;