Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support POSTGRES_HOST_AUTH_METHOD=peer #778

Closed
wants to merge 1 commit into from
Closed

Support POSTGRES_HOST_AUTH_METHOD=peer #778

wants to merge 1 commit into from

Conversation

nathanweeks
Copy link

Currently, only the "trust" auth-method is supported out-of-the-box for local connections. It could be useful to also support peer authentication to facilitate more convenient & secure deployments of applications where a postgres client that can benefit from the performance of a unix domain socket connection is colocated on the same host as the postgres server (e.g., via docker compose, or within a Kubernetes Pod).

This PR proposes adding support for setting the evironment variable POSTGRES_HOST_AUTH_METHOD=peer. Like POSTGRES_HOST_AUTH_METHOD=trust, this would obviate the need to set POSTGRES_PASSWORD.

When POSTGRES_HOST_AUTH_METHOD=peer, this PR also suggests also starting postgres with -c listen_addresses='' to disable listening on a TCP port for additional security (and to potentially help make client misconfiguration issues more obvious), although the initdb --auth=peer writes a pg_hba.conf that allows "ident" authentication for TCP connections (which I'm admittedly unfamiliar with, and don't know how commonly it would be used in practice).

Concerns/feedback/suggestions appreciated!

@tianon
Copy link
Member

tianon commented Oct 27, 2020

Similar to #713 (comment), I'd suggest POSTGRES_INITDB_ARGS=--auth=peer, which should do the trick.

@nathanweeks
Copy link
Author

@tianon : thanks for the tip! Setting POSTGRES_INITDB_ARGS=--auth=peer, POSTGRES_PASSWORD=some-phony-password, and adding -c listen_addresses='' to the CMD looks like it achieves the desired result. It might be useful to explicitly document this trick.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants