akritikos
5744f4b7db
- Implemented sync-roles.sh to synchronize Active Directory group memberships as MariaDB roles and user accounts. - Created Containerfile for building a custom ldap2pg image with patched YAML decoding. - Added provision-user-db.sh for provisioning user databases and roles based on LDAP synchronization. - Introduced a new Containerfile for MariaDB with PAM authentication via pam_ldap. - Configured PAM service for MariaDB logins and added necessary plugins for LDAP authentication. - Implemented health checks and entrypoint scripts for MariaDB and pgpool containers. - Enhanced PostgreSQL image with additional extensions and custom pg_hba.conf for improved security and functionality.
25 lines
1.1 KiB
Plaintext
25 lines
1.1 KiB
Plaintext
# Authoritative pg_hba.conf for this image.
|
|
#
|
|
# Activated via the hba_file GUC (see conf.d/20-hba.conf), so it fully replaces
|
|
# the initdb-generated $PGDATA/pg_hba.conf. This also means the docker-entrypoint's
|
|
# appended "host all all all ${POSTGRES_HOST_AUTH_METHOD}" line (written to the
|
|
# PGDATA copy) is never consulted -- ordering here is authoritative.
|
|
#
|
|
# pg_hba.conf is FIRST-MATCH-WINS, so the tiers are ordered deliberately:
|
|
# 1. local/loopback allows (first: nothing can lock out local admin)
|
|
# 2. site rules (include_dir /etc/postgresql/hba.d: mount files here)
|
|
# 3. default-deny (last: fail closed)
|
|
#
|
|
# TYPE DATABASE USER ADDRESS METHOD
|
|
|
|
# 1. Local socket + loopback
|
|
# local all all trust
|
|
host all all 127.0.0.1/32 scram-sha-256
|
|
host all all ::1/128 scram-sha-256
|
|
|
|
# 2. Site-specific rules (user-provided; mount *.conf files into this dir)
|
|
include_dir "/etc/postgresql/hba.d"
|
|
|
|
# 3. Default-deny catch-all
|
|
host all all all reject
|