4-enterprise-per-tenant.toml

# =============================================================================
# Mockup 3B: the same enterprise install, split by tenant instead of by file type.


# FILE: postgresql.toml
# =============================================================================
listen_addresses = "*"
max_connections = 2000
superuser_reserved_connections = 10

shared_buffers = "64GB"
effective_cache_size = "192GB"
work_mem = "64MB"
maintenance_work_mem = "4GB"

ssl = true
ssl_min_protocol_version = "TLSv1.3"
ssl_sni = true

[include]
files = ["tenant-acme.toml", "tenant-globex.toml"]

[hba._defaults]
transport = "tcp"
ssl = "required"

[hba.admin_cert]
method = "cert"
clientcert = "verify-full"
map = "admins"

[[hba.rules]]
transport = "local"
databases = "all"
users = "postgres"
method = "peer"

[[hba.rules]]
based_on = "admin_cert"
address = "10.99.0.0/24"
databases = "all"
users = "all"

[hosts._defaults]
ssl_ca = "/etc/postgresql/tls/internal-ca.crt"

[hosts."*"]
ssl_certificate = "/etc/postgresql/tls/default.crt"
ssl_key = "/etc/postgresql/tls/default.key"

[ident.admins]
'/^CN=([^,]+),OU=DBA,.*$' = '\1'
"CN=break-glass,OU=Ops,O=Example,C=US" = "postgres"


# FILE: tenant-acme.toml
# =============================================================================
[hosts."acme.db.example.com"]
ssl_certificate = "/etc/postgresql/tls/acme.crt"
ssl_key = "/etc/postgresql/tls/acme.key"

[[hba.rules]]
address = "10.10.0.0/16"
databases = "acme"
users = "all"
method = "oauth"
issuer = "https://login.acme.example.com/realms/acme"
scope = "openid profile email"
map = "acme"

[ident.acme]
'/^(.+)@acme\.com$' = '\1'
"svc-acme-etl@acme.com" = "acme_etl"


# FILE: tenant-globex.toml
# =============================================================================
[hosts."globex.db.example.com"]
ssl_certificate = "/etc/postgresql/tls/globex.crt"
ssl_key = "/etc/postgresql/tls/globex.key"
passphrase_command = "pass show pg/globex-key"

[hba.globex_ldap]
address = "10.20.0.0/16"
method = "ldap"
ldapurl = "ldaps://ldap.globex.example.com/dc=globex,dc=com?uid?sub"

[[hba.rules]]
based_on = "globex_ldap"
databases = "globex"
users = "all"

[[hba.rules]]
based_on = "globex_ldap"
databases = "globex_second"
users = "all"