* Jim Nasby (jim@nasby.net) wrote:
> Would the inclusion of the entire directory be done via a single #include (or whatever syntax) directive in
pg_hba.conf?
Not sure we've even figured that out yet, but probably.
> I think that's probably OK. But if we're talking about something like "hey, if there's a pg_hba.d directory then
magicallyslurp that in", that's far less useful and a much bigger foot-gun. (It also wouldn't provide any value for
whatJerry (the op) needs).
I agree that it's best to have it be explicit, though the packagers may
go ahead and set things up such that a pg_hba.d directory exists by
default on their distribution.
> To summarize, here's what I've seen on this discussion:
>
> - People seem to generally be in favor of the idea of "includes", though it's not completely clear if people want
specific"include file X at this point in the ruleset" or something more nebulous.
My thought would be to support both individual files and directories,
where files in a directory are included in C/POSIX lexical order.
> - It would be useful to have a mechanism for testing a pg_hba.conf file.
Agreed.
> - It would also be useful for denied connections to log the actual line/file that denied the connection.
Agreed- in the postmaster log, of course. We would not change the
response to the client.
> - This would be a good GSoC project.
That's my 2c on it at least.
Thanks,
Stephen
