ALTER DEFAULT PRIVILEGES FOR ddl_user IN SCHEMA public GRANT SELECT ON TABLES TO
readonly;
ALTER DEFAULT PRIVILEGES FOR ddl_user IN SCHEMA public GRANT SELECT ON SEQUENCES
TO readonly;
ALTER DEFAULT PRIVILEGES FOR ddl_user IN SCHEMA public GRANT EXECUTE ON FUNCTIONS
TO readonly;
The second part (New objects) is very important from my point of view, but it does not work.
Doesn't work how? Query fails? Or the permissions don't get granted?
What's the ddl_user role? Have you created it? Does it work if you leave the target role as the default? ie just run the ALTER DEFAULT without the "FOR ddl_user" section?