007: iwanhae OS user as PostgreSQL superuser via peer auth

migrations/007-postgres-admin-role.sh

@@ -0,0 +1,45 @@
+#!/usr/bin/env bash
+# 007-postgres-admin-role - Make the iwanhae Linux user a PostgreSQL
+# superuser so it can administer the cluster via peer auth (psql with no
+# password, like the postgres OS user). Requires 006 (cluster running).
+# up:   CREATE ROLE iwanhae LOGIN SUPERUSER (idempotent; re-run promotes)
+# down: DROP ROLE iwanhae (with hint if it owns objects in some database)
+set -euo pipefail
+
+ROLE=iwanhae
+
+role_exists() {
+  runuser -u postgres -- psql -v ON_ERROR_STOP=1 -tAc \
+    "SELECT 1 FROM pg_roles WHERE rolname='$ROLE'" | grep -q 1
+}
+
+case "${1:-}" in
+  up)
+    if role_exists; then
+      runuser -u postgres -- psql -v ON_ERROR_STOP=1 -qc \
+        "ALTER ROLE $ROLE WITH LOGIN SUPERUSER"
+      echo "    role $ROLE already existed - promoted to LOGIN SUPERUSER"
+    else
+      runuser -u postgres -- psql -v ON_ERROR_STOP=1 -qc \
+        "CREATE ROLE $ROLE WITH LOGIN SUPERUSER"
+      echo "    role $ROLE created: LOGIN SUPERUSER"
+    fi
+    # end-to-end proof: connect over the unix socket as the OS user (peer)
+    check=$(runuser -u "$ROLE" -- psql -d postgres -tAc \
+      "SELECT current_user || ' (superuser=' || rolsuper || ')' FROM pg_roles WHERE rolname = current_user")
+    echo "    peer-auth check: $check"
+    ;;
+  down)
+    if role_exists; then
+      if runuser -u postgres -- psql -v ON_ERROR_STOP=1 -qc "DROP ROLE $ROLE"; then
+        echo "    role $ROLE dropped"
+      else
+        echo "cannot drop $ROLE - it owns objects. In EVERY database it has objects run:" >&2
+        echo "  runuser -u postgres -- psql -d <db> -c 'DROP OWNED BY $ROLE;'" >&2
+        exit 1
+      fi
+    else
+      echo "    role $ROLE does not exist - nothing to do"
+    fi
+    ;;
+esac