Re: HBA files w/include support?

* Jim Nasby (jim(at)nasby(dot)net) wrote:
> Would the inclusion of the entire directory be done via a single #include (or whatever syntax) directive in pg_hba.conf?

Not sure we've even figured that out yet, but probably.

> I think that's probably OK. But if we're talking about something like "hey, if there's a pg_hba.d directory then magically slurp that in", that's far less useful and a much bigger foot-gun. (It also wouldn't provide any value for what Jerry (the op) needs).

I agree that it's best to have it be explicit, though the packagers may
go ahead and set things up such that a pg_hba.d directory exists by
default on their distribution.

> To summarize, here's what I've seen on this discussion:
>
> - People seem to generally be in favor of the idea of "includes", though it's not completely clear if people want specific "include file X at this point in the ruleset" or something more nebulous.

My thought would be to support both individual files and directories,
where files in a directory are included in C/POSIX lexical order.

> - It would be useful to have a mechanism for testing a pg_hba.conf file.

Agreed.

> - It would also be useful for denied connections to log the actual line/file that denied the connection.

Agreed- in the postmaster log, of course. We would not change the
response to the client.

> - This would be a good GSoC project.

That's my 2c on it at least.

Thanks,

Stephen