ALTER DEFAULT PRIVILEGES FOR ddl_user IN SCHEMA public GRANT SELECT ON TABLES TOreadonly;ALTER DEFAULT PRIVILEGES FOR ddl_user IN SCHEMA public GRANT SELECT ON SEQUENCESTO readonly;ALTER DEFAULT PRIVILEGES FOR ddl_user IN SCHEMA public GRANT EXECUTE ON FUNCTIONSTO readonly;The second part (New objects) is very important from my point of view, but it does not work.
Doesn't work how? Query fails? Or the permissions don't get granted?
What's the ddl_user role? Have you created it? Does it work if you leave the target role as the default? ie just run the ALTER DEFAULT without the "FOR ddl_user" section?