Skip to content

Commit 4e6292b

Browse files
committed
feat: switch to include directives in pg_hba
Using include directives makes changing the pg_hba.conf on the fly more flexible. Enabling / disabling ssl enforcement for example only requires creating or removing a file, leaving the pg_hba.conf untouched. Allowing for more repeatable and stable processes and no need for regex based replace or custom parsers. This will also support the just-in-time access work by allowing jit to be dynamically enabled/disabled
1 parent 714cb2a commit 4e6292b

13 files changed

Lines changed: 367 additions & 240 deletions

Dockerfile-15

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -207,7 +207,7 @@ COPY --from=groonga /tmp/groonga-plugins/plugins /usr/lib/groonga/plugins
207207

208208
# # Initialise configs
209209
COPY --chown=postgres:postgres ansible/files/postgresql_config/postgresql.conf.j2 /etc/postgresql/postgresql.conf
210-
COPY --chown=postgres:postgres ansible/files/postgresql_config/pg_hba.conf.j2 /etc/postgresql/pg_hba.conf
210+
COPY --chown=postgres:postgres ansible/files/postgresql_config/pg_hba.conf_15.j2 /etc/postgresql/pg_hba.conf
211211
COPY --chown=postgres:postgres ansible/files/postgresql_config/pg_ident.conf.j2 /etc/postgresql/pg_ident.conf
212212
COPY --chown=postgres:postgres ansible/files/postgresql_config/conf.d /etc/postgresql-custom/conf.d
213213
COPY --chown=postgres:postgres ansible/files/postgresql_config/postgresql-stdout-log.conf /etc/postgresql/logging.conf

Dockerfile-17

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -212,6 +212,8 @@ COPY --from=groonga /tmp/groonga-plugins/plugins /usr/lib/groonga/plugins
212212
# # Initialise configs
213213
COPY --chown=postgres:postgres ansible/files/postgresql_config/postgresql.conf.j2 /etc/postgresql/postgresql.conf
214214
COPY --chown=postgres:postgres ansible/files/postgresql_config/pg_hba.conf.j2 /etc/postgresql/pg_hba.conf
215+
COPY --chown=postgres:postgres ansible/files/postgresql_config/pg_hba_users_public.conf.j2 /etc/postgresql/pg_hba_users_public.conf
216+
COPY --chown=postgres:postgres ansible/files/postgresql_config/pg_hba_public.conf.j2 /etc/postgresql/pg_hba_public.conf
215217
COPY --chown=postgres:postgres ansible/files/postgresql_config/pg_ident.conf.j2 /etc/postgresql/pg_ident.conf
216218
COPY --chown=postgres:postgres ansible/files/postgresql_config/conf.d /etc/postgresql-custom/conf.d
217219
COPY --chown=postgres:postgres ansible/files/postgresql_config/postgresql-stdout-log.conf /etc/postgresql/logging.conf

Dockerfile-orioledb-17

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -212,6 +212,8 @@ COPY --from=groonga /tmp/groonga-plugins/plugins /usr/lib/groonga/plugins
212212
# # Initialise configs
213213
COPY --chown=postgres:postgres ansible/files/postgresql_config/postgresql.conf.j2 /etc/postgresql/postgresql.conf
214214
COPY --chown=postgres:postgres ansible/files/postgresql_config/pg_hba.conf.j2 /etc/postgresql/pg_hba.conf
215+
COPY --chown=postgres:postgres ansible/files/postgresql_config/pg_hba_users_public.conf.j2 /etc/postgresql/pg_hba_users_public.conf
216+
COPY --chown=postgres:postgres ansible/files/postgresql_config/pg_hba_public.conf.j2 /etc/postgresql/pg_hba_public.conf
215217
COPY --chown=postgres:postgres ansible/files/postgresql_config/pg_ident.conf.j2 /etc/postgresql/pg_ident.conf
216218
COPY --chown=postgres:postgres ansible/files/postgresql_config/conf.d /etc/postgresql-custom/conf.d
217219
COPY --chown=postgres:postgres ansible/files/postgresql_config/postgresql-stdout-log.conf /etc/postgresql/logging.conf
Lines changed: 20 additions & 79 deletions
Original file line numberDiff line numberDiff line change
@@ -1,94 +1,35 @@
11
# PostgreSQL Client Authentication Configuration File
22
# ===================================================
33
#
4-
# Refer to the "Client Authentication" section in the PostgreSQL
5-
# documentation for a complete description of this file. A short
6-
# synopsis follows.
7-
#
8-
# This file controls: which hosts are allowed to connect, how clients
9-
# are authenticated, which PostgreSQL user names they can use, which
10-
# databases they can access. Records take one of these forms:
11-
#
12-
# local DATABASE USER METHOD [OPTIONS]
13-
# host DATABASE USER ADDRESS METHOD [OPTIONS]
14-
# hostssl DATABASE USER ADDRESS METHOD [OPTIONS]
15-
# hostnossl DATABASE USER ADDRESS METHOD [OPTIONS]
16-
# hostgssenc DATABASE USER ADDRESS METHOD [OPTIONS]
17-
# hostnogssenc DATABASE USER ADDRESS METHOD [OPTIONS]
18-
#
19-
# (The uppercase items must be replaced by actual values.)
20-
#
21-
# The first field is the connection type: "local" is a Unix-domain
22-
# socket, "host" is either a plain or SSL-encrypted TCP/IP socket,
23-
# "hostssl" is an SSL-encrypted TCP/IP socket, and "hostnossl" is a
24-
# non-SSL TCP/IP socket. Similarly, "hostgssenc" uses a
25-
# GSSAPI-encrypted TCP/IP socket, while "hostnogssenc" uses a
26-
# non-GSSAPI socket.
27-
#
28-
# DATABASE can be "all", "sameuser", "samerole", "replication", a
29-
# database name, or a comma-separated list thereof. The "all"
30-
# keyword does not match "replication". Access to replication
31-
# must be enabled in a separate record (see example below).
32-
#
33-
# USER can be "all", a user name, a group name prefixed with "+", or a
34-
# comma-separated list thereof. In both the DATABASE and USER fields
35-
# you can also write a file name prefixed with "@" to include names
36-
# from a separate file.
37-
#
38-
# ADDRESS specifies the set of hosts the record matches. It can be a
39-
# host name, or it is made up of an IP address and a CIDR mask that is
40-
# an integer (between 0 and 32 (IPv4) or 128 (IPv6) inclusive) that
41-
# specifies the number of significant bits in the mask. A host name
42-
# that starts with a dot (.) matches a suffix of the actual host name.
43-
# Alternatively, you can write an IP address and netmask in separate
44-
# columns to specify the set of hosts. Instead of a CIDR-address, you
45-
# can write "samehost" to match any of the server's own IP addresses,
46-
# or "samenet" to match any address in any subnet that the server is
47-
# directly connected to.
48-
#
49-
# METHOD can be "trust", "reject", "md5", "password", "scram-sha-256",
50-
# "gss", "sspi", "ident", "peer", "pam", "ldap", "radius" or "cert".
51-
# Note that "password" sends passwords in clear text; "md5" or
52-
# "scram-sha-256" are preferred since they send encrypted passwords.
53-
#
54-
# OPTIONS are a set of options for the authentication in the format
55-
# NAME=VALUE. The available options depend on the different
56-
# authentication methods -- refer to the "Client Authentication"
57-
# section in the documentation for a list of which options are
58-
# available for which authentication methods.
59-
#
60-
# Database and user names containing spaces, commas, quotes and other
61-
# special characters must be quoted. Quoting one of the keywords
62-
# "all", "sameuser", "samerole" or "replication" makes the name lose
63-
# its special character, and just match a database or username with
64-
# that name.
65-
#
66-
# This file is read on server startup and when the server receives a
67-
# SIGHUP signal. If you edit the file on a running system, you have to
68-
# SIGHUP the server for the changes to take effect, run "pg_ctl reload",
69-
# or execute "SELECT pg_reload_conf()".
70-
#
71-
# Put your actual configuration here
72-
# ----------------------------------
73-
#
74-
# If you want to allow non-local connections, you need to add more
75-
# "host" records. In that case you will also need to make PostgreSQL
76-
# listen on a non-local interface via the listen_addresses
77-
# configuration parameter, or via the -i or -h command line switches.
4+
# This file uses the include directive to selectively
5+
# enable features. When present, the included files will
6+
# take effect and order of precedence determines which auth
7+
# rules are applied.
788

799
# TYPE DATABASE USER ADDRESS METHOD
8010

8111
# trust local connections
8212
local all supabase_admin scram-sha-256
8313
local all all peer map=supabase_map
14+
15+
include_if_exists pg_hba_pam_local.conf
16+
8417
host all all 127.0.0.1/32 trust
8518
host all all ::1/128 trust
8619

87-
# IPv4 external connections
8820
host all all 10.0.0.0/8 scram-sha-256
89-
host all all 172.16.0.0/12 scram-sha-256
21+
host all all 172.16.0.0/12 scram-sha-256
9022
host all all 192.168.0.0/16 scram-sha-256
91-
host all all 0.0.0.0/0 scram-sha-256
9223

93-
# IPv6 external connections
94-
host all all ::0/0 scram-sha-256
24+
# if ssl is enforced, these files will exist and take precedence
25+
include_if_exists pg_hba_users_public_ssl.conf
26+
include_if_exists pg_hba_pam_public_ssl.conf
27+
include_if_exists pg_hba_public_ssl.conf
28+
29+
# otherwise, non ssl enforced rules will apply
30+
include_if_exists pg_hba_users_public.conf
31+
include_if_exists pg_hba_pam_public.conf
32+
include_if_exists pg_hba_public.conf
33+
34+
host replication supabase_replication_admin 0.0.0.0/0 scram-sha-256
35+
host replication supabase_replication_admin ::0/0 scram-sha-256
Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
# PostgreSQL Client Authentication Configuration File
2+
# ===================================================
3+
#
4+
# Refer to the "Client Authentication" section in the PostgreSQL
5+
# documentation for a complete description of this file. A short
6+
# synopsis follows.
7+
#
8+
# This file controls: which hosts are allowed to connect, how clients
9+
# are authenticated, which PostgreSQL user names they can use, which
10+
# databases they can access. Records take one of these forms:
11+
#
12+
# local DATABASE USER METHOD [OPTIONS]
13+
# host DATABASE USER ADDRESS METHOD [OPTIONS]
14+
# hostssl DATABASE USER ADDRESS METHOD [OPTIONS]
15+
# hostnossl DATABASE USER ADDRESS METHOD [OPTIONS]
16+
# hostgssenc DATABASE USER ADDRESS METHOD [OPTIONS]
17+
# hostnogssenc DATABASE USER ADDRESS METHOD [OPTIONS]
18+
#
19+
# (The uppercase items must be replaced by actual values.)
20+
#
21+
# The first field is the connection type: "local" is a Unix-domain
22+
# socket, "host" is either a plain or SSL-encrypted TCP/IP socket,
23+
# "hostssl" is an SSL-encrypted TCP/IP socket, and "hostnossl" is a
24+
# non-SSL TCP/IP socket. Similarly, "hostgssenc" uses a
25+
# GSSAPI-encrypted TCP/IP socket, while "hostnogssenc" uses a
26+
# non-GSSAPI socket.
27+
#
28+
# DATABASE can be "all", "sameuser", "samerole", "replication", a
29+
# database name, or a comma-separated list thereof. The "all"
30+
# keyword does not match "replication". Access to replication
31+
# must be enabled in a separate record (see example below).
32+
#
33+
# USER can be "all", a user name, a group name prefixed with "+", or a
34+
# comma-separated list thereof. In both the DATABASE and USER fields
35+
# you can also write a file name prefixed with "@" to include names
36+
# from a separate file.
37+
#
38+
# ADDRESS specifies the set of hosts the record matches. It can be a
39+
# host name, or it is made up of an IP address and a CIDR mask that is
40+
# an integer (between 0 and 32 (IPv4) or 128 (IPv6) inclusive) that
41+
# specifies the number of significant bits in the mask. A host name
42+
# that starts with a dot (.) matches a suffix of the actual host name.
43+
# Alternatively, you can write an IP address and netmask in separate
44+
# columns to specify the set of hosts. Instead of a CIDR-address, you
45+
# can write "samehost" to match any of the server's own IP addresses,
46+
# or "samenet" to match any address in any subnet that the server is
47+
# directly connected to.
48+
#
49+
# METHOD can be "trust", "reject", "md5", "password", "scram-sha-256",
50+
# "gss", "sspi", "ident", "peer", "pam", "ldap", "radius" or "cert".
51+
# Note that "password" sends passwords in clear text; "md5" or
52+
# "scram-sha-256" are preferred since they send encrypted passwords.
53+
#
54+
# OPTIONS are a set of options for the authentication in the format
55+
# NAME=VALUE. The available options depend on the different
56+
# authentication methods -- refer to the "Client Authentication"
57+
# section in the documentation for a list of which options are
58+
# available for which authentication methods.
59+
#
60+
# Database and user names containing spaces, commas, quotes and other
61+
# special characters must be quoted. Quoting one of the keywords
62+
# "all", "sameuser", "samerole" or "replication" makes the name lose
63+
# its special character, and just match a database or username with
64+
# that name.
65+
#
66+
# This file is read on server startup and when the server receives a
67+
# SIGHUP signal. If you edit the file on a running system, you have to
68+
# SIGHUP the server for the changes to take effect, run "pg_ctl reload",
69+
# or execute "SELECT pg_reload_conf()".
70+
#
71+
# Put your actual configuration here
72+
# ----------------------------------
73+
#
74+
# If you want to allow non-local connections, you need to add more
75+
# "host" records. In that case you will also need to make PostgreSQL
76+
# listen on a non-local interface via the listen_addresses
77+
# configuration parameter, or via the -i or -h command line switches.
78+
79+
# TYPE DATABASE USER ADDRESS METHOD
80+
81+
# trust local connections
82+
local all supabase_admin scram-sha-256
83+
local all all peer map=supabase_map
84+
host all all 127.0.0.1/32 trust
85+
host all all ::1/128 trust
86+
87+
# IPv4 external connections
88+
host all all 10.0.0.0/8 scram-sha-256
89+
host all all 172.16.0.0/12 scram-sha-256
90+
host all all 192.168.0.0/16 scram-sha-256
91+
host all all 0.0.0.0/0 scram-sha-256
92+
93+
# IPv6 external connections
94+
host all all ::0/0 scram-sha-256
95+
Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
host all all 0.0.0.0/0 scram-sha-256
2+
host all all ::0/0 scram-sha-256
Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
host all pgbouncer 0.0.0.0/0 scram-sha-256
2+
host all supabase_admin 0.0.0.0/0 scram-sha-256
3+
host all supabase_auth_admin 0.0.0.0/0 scram-sha-256
4+
host all supabase_storage_admin 0.0.0.0/0 scram-sha-256
5+
host all supabase_replication_admin 0.0.0.0/0 scram-sha-256
6+
7+
host all pgbouncer ::0/0 scram-sha-256
8+
host all supabase_admin ::0/0 scram-sha-256
9+
host all supabase_auth_admin ::0/0 scram-sha-256
10+
host all supabase_storage_admin ::0/0 scram-sha-256
11+
host all supabase_replication_admin ::0/0 scram-sha-256

0 commit comments

Comments
 (0)