03-enterprise-multitenant.toml

# =============================================================================
# Mockup 3 of 3: a large multi-tenant enterprise installation.


# FILE: postgresql.toml
# =============================================================================
listen_addresses = "*"
max_connections = 2000
superuser_reserved_connections = 10

shared_buffers = "64GB"
effective_cache_size = "192GB"
work_mem = "64MB"
maintenance_work_mem = "4GB"

ssl = true
ssl_min_protocol_version = "TLSv1.3"
ssl_sni = true

[include]
files = ["pg_hosts.toml", "pg_hba.toml", "pg_ident.toml"]


# FILE: pg_hosts.toml
# =============================================================================
[hosts._defaults]
ssl_ca = "/etc/postgresql/tls/internal-ca.crt"

[hosts."acme.db.example.com"]
ssl_certificate = "/etc/postgresql/tls/acme.crt"
ssl_key = "/etc/postgresql/tls/acme.key"

[hosts."globex.db.example.com"]
ssl_certificate = "/etc/postgresql/tls/globex.crt"
ssl_key = "/etc/postgresql/tls/globex.key"
passphrase_command = "pass show pg/globex-key"

[hosts."*"]
ssl_certificate = "/etc/postgresql/tls/default.crt"
ssl_key = "/etc/postgresql/tls/default.key"


# FILE: pg_hba.toml
# =============================================================================
[hba._defaults]
transport = "tcp"
ssl = "required"

[hba.acme_oauth]
address = "10.10.0.0/16"
method = "oauth"
issuer = "https://login.acme.example.com/realms/acme"
scope = "openid profile email"
map = "acme_oauth"

[hba.globex_ldap]
address = "10.20.0.0/16"
method = "ldap"
ldapurl = "ldaps://ldap.globex.example.com/dc=globex,dc=com?uid?sub"
# ...

[hba.admin_cert]
method = "cert"
clientcert = "verify-full"
map = "admins"

[[hba.rules]]
transport = "local"
databases = "all"
users = "postgres"
method = "peer"

[[hba.rules]]
based_on = "admin_cert"
address = "10.99.0.0/24"
databases = "all"
users = "all"

[[hba.rules]]
based_on = "acme_oauth"
databases = "acme"
users = "all"

[[hba.rules]]
based_on = "globex_ldap"
databases = "globex"
users = "all"

[[hba.rules]]
based_on = "globex_ldap"
databases = "globex_second"
users = "all"


# FILE: pg_ident.toml
# =============================================================================

[ident]

[ident.acme_oauth]
'/^(.+)@acme\.com$' = '\1'
"svc-acme-etl@acme.com" = "acme_etl"

[ident.admins]
'/^CN=([^,]+),OU=DBA,.*$' = '\1'
"CN=break-glass,OU=Ops,O=Example,C=US" = "postgres"