# Host-based authentication for the reference deployment's PostgreSQL (ADR 0018, ADR 0044).
#
# Mounted read-only and selected with `-c hba_file=...` (deploy/compose.yaml), so it replaces the
# image's generated file entirely. Rules are matched top to bottom; the first match decides.

# TYPE      DATABASE  USER  ADDRESS  METHOD

# The container's own Unix socket: the image's first-start initialization and the health check.
# Nothing outside the container can reach it.
local       all       all            trust

# Every network connection must be TLS (the server enforces TLS 1.3) and authenticate with SCRAM.
hostssl     all       all   all      scram-sha-256

# A network connection without TLS is refused outright, before authentication.
hostnossl   all       all   all      reject