* Jim Nasby (j...@nasby.net) wrote: > Would the inclusion of the entire directory be done via a single #include (or > whatever syntax) directive in pg_hba.conf?
Not sure we've even figured that out yet, but probably.
> I think that's probably OK. But if we're talking about something like "hey,
> if there's a pg_hba.d directory then magically slurp that in", that's far
> less useful and a much bigger foot-gun. (It also wouldn't provide any value
> for what Jerry (the op) needs).
I agree that it's best to have it be explicit, though the packagers may
go ahead and set things up such that a pg_hba.d directory exists by
default on their distribution.
> To summarize, here's what I've seen on this discussion:
>
> - People seem to generally be in favor of the idea of "includes", though it's
> not completely clear if people want specific "include file X at this point in
> the ruleset" or something more nebulous.
My thought would be to support both individual files and directories,
where files in a directory are included in C/POSIX lexical order.
> - It would be useful to have a mechanism for testing a pg_hba.conf file.
Agreed.
> - It would also be useful for denied connections to log the actual line/file
> that denied the connection.
Agreed- in the postmaster log, of course. We would not change the
response to the client.
> - This would be a good GSoC project.
That's my 2c on it at least.
Thanks,
Stephen
signature.asc
Description: Digital signature
