01-simple-production.toml

# =============================================================================
# Mockup 1: a simple single-node production PostgreSQL installation.
#
# This whole configuration lives in ONE file, postgresql.toml. 
# There is no pg_hba.toml / pg_hosts.toml / pg_ident.toml

listen_addresses = "*"
max_connections = 200

shared_buffers = "8GB"
effective_cache_size = "24GB"
work_mem = "32MB"
maintenance_work_mem = "1GB"
max_wal_size = "4GB"

ssl = true
ssl_cert_file = "/etc/postgresql/tls/server.crt"
ssl_key_file = "/etc/postgresql/tls/server.key"

[hba]
[hba._defaults]
# default to secure TLS-only TCP
method = "scram-sha-256"
transport = "tcp"
ssl = "required"

[[hba.rules]]
# Superuser maintenance over the local unix socket.
transport = "local"
databases = "all"
users = "postgres"
method = "peer"

[[hba.rules]]
# The application, from the app subnet, into its own database
address = "10.20.0.0/24"
databases = "appdb"
users = "app"

[[hba.rules]]
# Read-only reporting role, same database
address = "10.20.0.0/24"
databases = "appdb"
users = "report_ro"

[[hba.rules]]
# DBAs from the office VPN, any database
address = "10.99.0.0/24"
databases = "all"
users = ["dba", "postgres"]