From 529a94419e99c8bc81303d6a423be87c5c87c2b5 Mon Sep 17 00:00:00 2001
From: Lexi Winter <lexi@le-fay.org>
Date: Tue, 22 Jul 2025 08:57:54 +0100
Subject: add a hook for postgres

---
 Makefile    |  1 +
 postgres.sh | 27 +++++++++++++++++++++++++++
 2 files changed, 28 insertions(+)
 create mode 100644 postgres.sh

diff --git a/Makefile b/Makefile
index 0c06c0b..6af7c3c 100644
--- a/Makefile
+++ b/Makefile
@@ -10,6 +10,7 @@ HOOKS=	apache24.sh \
 	opendkim.sh \
 	pf.sh \
 	postfix.sh \
+	postgres.sh \
 	unbound.sh
 
 all: .PHONY
diff --git a/postgres.sh b/postgres.sh
new file mode 100644
index 0000000..5c0b97d
--- /dev/null
+++ b/postgres.sh
@@ -0,0 +1,27 @@
+# This source code is released into the public domain.
+#
+# Postgres doesn't support any sort of defined ACL, so instead we just add
+# hostssl entries for each prefix.
+
+POSTGRES_FILE="/var/db/postgres/pg_hba.ldap"
+POSTGRES_TEMP="${POSTGRES_FILE}.ldaptmp"
+
+if [ ! -f "$POSTGRES_FILE" ]; then
+	exit 0
+fi
+
+awk <"$NETWORKS_FILE" >"$POSTGRES_TEMP" '{
+	print "hostssl all all " $1 " scram-sha-256"
+}'
+
+if cmp -s "$POSTGRES_TEMP" "$POSTGRES_FILE"; then
+	rm "$POSTGRES_TEMP"
+	exit 0
+fi
+
+printf '%s updated:\n\n' "$POSTGRES_FILE"
+diff "$POSTGRES_FILE" "$POSTGRES_TEMP"
+printf '\n'
+
+mv "$POSTGRES_TEMP" "$POSTGRES_FILE" 
+/usr/sbin/service postgresql reload
-- 
cgit v1.2.3