Support POSTGRES_HOST_AUTH_METHOD=peer #778
Closed
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Currently, only the "trust" auth-method is supported out-of-the-box for local connections. It could be useful to also support peer authentication to facilitate more convenient & secure deployments of applications where a postgres client that can benefit from the performance of a unix domain socket connection is colocated on the same host as the postgres server (e.g., via docker compose, or within a Kubernetes Pod).
This PR proposes adding support for setting the evironment variable
POSTGRES_HOST_AUTH_METHOD=peer
. LikePOSTGRES_HOST_AUTH_METHOD=trust
, this would obviate the need to set POSTGRES_PASSWORD.When
POSTGRES_HOST_AUTH_METHOD=peer
, this PR also suggests also starting postgres with-c listen_addresses=''
to disable listening on a TCP port for additional security (and to potentially help make client misconfiguration issues more obvious), although theinitdb --auth=peer
writes a pg_hba.conf that allows "ident" authentication for TCP connections (which I'm admittedly unfamiliar with, and don't know how commonly it would be used in practice).Concerns/feedback/suggestions appreciated!