The control room needs APP_DATABASE_URL, a direct Postgres connection as the app role.
APP_DATABASE_URL
app
The four runtime roles are created NOLOGIN on purpose — a password in a migration is a password in the repo. See db/roles-setup.md.
NOLOGIN
db/roles-setup.md