I have a first server running a Postgres database. I have allowed remote access to this database, using certificates for authentification (following this tutorial).
Now I have a second server running a Django app on Apache. The user used by Apache is www-data, and I have understood it is good practice to give this user very restricted permissions.
In order to let django access its remote DB, I have added a .postgresql folder in the user www-data home folder (ie /var/wwww) containing all the needed files - root.crt (trusted root certificate), postgresql.crt (client certificate) and postgresql.key (client private key).
Of course if 'someone' gets access to those files, he will be able to connect to my DB and read/write on it.
Is this setup dangerous? If yes, can it be avoided?