If the database is local, use postgres peer authentication. Otherwise, use a password file. Leave database initialisation to postgresql.ensure*. Leave /var/lib/roundcube creation to systemd. Run php upgrade script as unpriviledged user.