setup: restrict access to db file and add CLI tool for running setup