checkId: check.db.permissions plugin: stellaops.doctor.database severity: fail tags: [database, postgres, permissions, security]

Database Permissions

This Doctor check verifies that the database account Stella Ops connects with has the right level of privilege — enough to run startup migrations and normal CRUD, but not so much that a compromise becomes a database takeover. It is aimed at operators hardening a deployment or triaging schema-access failures.

What It Checks

Inspects the current PostgreSQL user: whether it is a superuser, whether it can create databases or roles, and whether it has access to the application schemas.

The check warns when the application runs as a superuser and fails when the user cannot use the public schema.

Why It Matters

Over-privileged accounts increase blast radius. Under-privileged accounts break startup migrations and normal CRUD paths.

Common Causes

How to Fix

Docker Compose

docker compose -f devops/compose/docker-compose.stella-ops.yml exec postgres psql -U postgres -d stellaops -c "CREATE USER stellaops WITH PASSWORD '<strong-password>';"
docker compose -f devops/compose/docker-compose.stella-ops.yml exec postgres psql -U postgres -d stellaops -c "GRANT CONNECT ON DATABASE stellaops TO stellaops;"
docker compose -f devops/compose/docker-compose.stella-ops.yml exec postgres psql -U postgres -d stellaops -c "GRANT USAGE ON SCHEMA public TO stellaops;"
docker compose -f devops/compose/docker-compose.stella-ops.yml exec postgres psql -U postgres -d stellaops -c "GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO stellaops;"

Update ConnectionStrings__DefaultConnection after the grants are in place.

Bare Metal / systemd

psql -h <db-host> -U postgres -d <db-name> -c "ALTER ROLE <app-user> NOSUPERUSER NOCREATEDB NOCREATEROLE;"

Kubernetes / Helm

kubectl exec -n <namespace> <postgres-pod> -- psql -U postgres -d <db-name> -c "\du"

Verification

stella doctor --check check.db.permissions