install_ckan_datastore

# create readonly readonlyuser
sudo -u postgres createuser -S -D -R -P -l readonlyuser

# drop old datastore_default db if exists
sudo -u postgres dropdb datastore_default

# create datastore_default
sudo -u postgres createdb -O ckan_default datastore_default

# make ckan_default read, write and create tables on databases ckan_default and datastore_default
# make readonlyuser read tables created on databases datastore_default by user ckan_default
sudo -u postgres psql postgres -f /tmp/set_permissions.sql
# you can see /tmp/set_permissions.sql at http://pastebin.com/FDnt6EhS

# reload postgres settings
sudo -u postgres psql -c "select pg_reload_conf();"

# test it out
# ckan_default create table _foo in database ckan_default
sudo -u postgres psql -d datastore_default -U ckan_default -c "CREATE TABLE _foo();"

# user ckan_default can read table _foo so table created ok
sudo -u postgres psql -d datastore_default -U ckan_default -c "select * from _foo;"

# user readonlyuser cannot read table _foo
sudo -u postgres psql -d datastore_default -U readonlyuser -c "select * from _foo;"
ERROR:  permission denied for relation _foo