# Authoritative pg_hba.conf for this image.
#
# Activated via the hba_file GUC (see conf.d/20-hba.conf), so it fully replaces
# the initdb-generated $PGDATA/pg_hba.conf. This also means the docker-entrypoint's
# appended "host all all all ${POSTGRES_HOST_AUTH_METHOD}" line (written to the
# PGDATA copy) is never consulted -- ordering here is authoritative.
#
# pg_hba.conf is FIRST-MATCH-WINS, so the tiers are ordered deliberately:
#   1. local/loopback allows  (first: nothing can lock out local admin)
#   2. site rules             (include_dir /etc/postgresql/hba.d: mount files here)
#   3. default-deny           (last: fail closed)
#
# TYPE     DATABASE  USER  ADDRESS         METHOD

# 1. Local socket + loopback
# local      all       all                   trust
host       all       all   127.0.0.1/32    scram-sha-256
host       all       all   ::1/128         scram-sha-256

# 2. Site-specific rules (user-provided; mount *.conf files into this dir)
include_dir "/etc/postgresql/hba.d"

# 3. Default-deny catch-all
host       all       all   all             reject