|
1 | 1 | # PostgreSQL Client Authentication Configuration File |
2 | 2 | # =================================================== |
3 | 3 | # |
4 | | -# Refer to the "Client Authentication" section in the PostgreSQL |
5 | | -# documentation for a complete description of this file. A short |
6 | | -# synopsis follows. |
7 | | -# |
8 | | -# This file controls: which hosts are allowed to connect, how clients |
9 | | -# are authenticated, which PostgreSQL user names they can use, which |
10 | | -# databases they can access. Records take one of these forms: |
11 | | -# |
12 | | -# local DATABASE USER METHOD [OPTIONS] |
13 | | -# host DATABASE USER ADDRESS METHOD [OPTIONS] |
14 | | -# hostssl DATABASE USER ADDRESS METHOD [OPTIONS] |
15 | | -# hostnossl DATABASE USER ADDRESS METHOD [OPTIONS] |
16 | | -# hostgssenc DATABASE USER ADDRESS METHOD [OPTIONS] |
17 | | -# hostnogssenc DATABASE USER ADDRESS METHOD [OPTIONS] |
18 | | -# |
19 | | -# (The uppercase items must be replaced by actual values.) |
20 | | -# |
21 | | -# The first field is the connection type: "local" is a Unix-domain |
22 | | -# socket, "host" is either a plain or SSL-encrypted TCP/IP socket, |
23 | | -# "hostssl" is an SSL-encrypted TCP/IP socket, and "hostnossl" is a |
24 | | -# non-SSL TCP/IP socket. Similarly, "hostgssenc" uses a |
25 | | -# GSSAPI-encrypted TCP/IP socket, while "hostnogssenc" uses a |
26 | | -# non-GSSAPI socket. |
27 | | -# |
28 | | -# DATABASE can be "all", "sameuser", "samerole", "replication", a |
29 | | -# database name, or a comma-separated list thereof. The "all" |
30 | | -# keyword does not match "replication". Access to replication |
31 | | -# must be enabled in a separate record (see example below). |
32 | | -# |
33 | | -# USER can be "all", a user name, a group name prefixed with "+", or a |
34 | | -# comma-separated list thereof. In both the DATABASE and USER fields |
35 | | -# you can also write a file name prefixed with "@" to include names |
36 | | -# from a separate file. |
37 | | -# |
38 | | -# ADDRESS specifies the set of hosts the record matches. It can be a |
39 | | -# host name, or it is made up of an IP address and a CIDR mask that is |
40 | | -# an integer (between 0 and 32 (IPv4) or 128 (IPv6) inclusive) that |
41 | | -# specifies the number of significant bits in the mask. A host name |
42 | | -# that starts with a dot (.) matches a suffix of the actual host name. |
43 | | -# Alternatively, you can write an IP address and netmask in separate |
44 | | -# columns to specify the set of hosts. Instead of a CIDR-address, you |
45 | | -# can write "samehost" to match any of the server's own IP addresses, |
46 | | -# or "samenet" to match any address in any subnet that the server is |
47 | | -# directly connected to. |
48 | | -# |
49 | | -# METHOD can be "trust", "reject", "md5", "password", "scram-sha-256", |
50 | | -# "gss", "sspi", "ident", "peer", "pam", "ldap", "radius" or "cert". |
51 | | -# Note that "password" sends passwords in clear text; "md5" or |
52 | | -# "scram-sha-256" are preferred since they send encrypted passwords. |
53 | | -# |
54 | | -# OPTIONS are a set of options for the authentication in the format |
55 | | -# NAME=VALUE. The available options depend on the different |
56 | | -# authentication methods -- refer to the "Client Authentication" |
57 | | -# section in the documentation for a list of which options are |
58 | | -# available for which authentication methods. |
59 | | -# |
60 | | -# Database and user names containing spaces, commas, quotes and other |
61 | | -# special characters must be quoted. Quoting one of the keywords |
62 | | -# "all", "sameuser", "samerole" or "replication" makes the name lose |
63 | | -# its special character, and just match a database or username with |
64 | | -# that name. |
65 | | -# |
66 | | -# This file is read on server startup and when the server receives a |
67 | | -# SIGHUP signal. If you edit the file on a running system, you have to |
68 | | -# SIGHUP the server for the changes to take effect, run "pg_ctl reload", |
69 | | -# or execute "SELECT pg_reload_conf()". |
70 | | -# |
71 | | -# Put your actual configuration here |
72 | | -# ---------------------------------- |
73 | | -# |
74 | | -# If you want to allow non-local connections, you need to add more |
75 | | -# "host" records. In that case you will also need to make PostgreSQL |
76 | | -# listen on a non-local interface via the listen_addresses |
77 | | -# configuration parameter, or via the -i or -h command line switches. |
| 4 | +# This file uses the include directive to selectively |
| 5 | +# enable features. When present, the included files will |
| 6 | +# take effect and order of precedence determines which auth |
| 7 | +# rules are applied. |
78 | 8 |
|
79 | 9 | # TYPE DATABASE USER ADDRESS METHOD |
80 | 10 |
|
81 | 11 | # trust local connections |
82 | 12 | local all supabase_admin scram-sha-256 |
83 | 13 | local all all peer map=supabase_map |
| 14 | + |
| 15 | +include_if_exists pg_hba_pam_local.conf |
| 16 | + |
84 | 17 | host all all 127.0.0.1/32 trust |
85 | 18 | host all all ::1/128 trust |
86 | 19 |
|
87 | | -# IPv4 external connections |
88 | 20 | host all all 10.0.0.0/8 scram-sha-256 |
89 | | -host all all 172.16.0.0/12 scram-sha-256 |
| 21 | +host all all 172.16.0.0/12 scram-sha-256 |
90 | 22 | host all all 192.168.0.0/16 scram-sha-256 |
91 | | -host all all 0.0.0.0/0 scram-sha-256 |
92 | 23 |
|
93 | | -# IPv6 external connections |
94 | | -host all all ::0/0 scram-sha-256 |
| 24 | +# if ssl is enforced, these files will exist and take precedence |
| 25 | +include_if_exists pg_hba_users_public_ssl.conf |
| 26 | +include_if_exists pg_hba_pam_public_ssl.conf |
| 27 | +include_if_exists pg_hba_public_ssl.conf |
| 28 | + |
| 29 | +# otherwise, non ssl enforced rules will apply |
| 30 | +include_if_exists pg_hba_users_public.conf |
| 31 | +include_if_exists pg_hba_pam_public.conf |
| 32 | +include_if_exists pg_hba_public.conf |
| 33 | + |
| 34 | +host replication supabase_replication_admin 0.0.0.0/0 scram-sha-256 |
| 35 | +host replication supabase_replication_admin ::0/0 scram-sha-256 |
0 commit comments