Postgres Auth Notes

The Problem

When the Go app container is rebuilt or recreated, Docker assigns it a new internal IP. If PostgreSQL is configured to use scram-sha-256 for all connections, the stored SCRAM hash sometimes becomes invalid after recreation, causing:

FATAL: password authentication failed for user "taskqueue"

The Fix — Custom pg_hba.conf

The repo includes a pg_hba.conf tracked in version control and mounted read-only into the postgres container:

# Allow trust auth for Docker's internal 172.x.x.x network
host all all 172.0.0.0/8 trust

# Use SCRAM-SHA-256 for all external connections
host all all 0.0.0.0/0 scram-sha-256

Docker containers communicate via 172.x.x.x addresses — they always get trust auth regardless of the stored password hash. This permanently resolves the SCRAM failure issue.

If You Still Get Auth Failures

Run the one-shot fix script from the VPS:

cd /opt/riftcloud
bash fix_scram.sh

This resets the SCRAM-SHA-256 password hash and restarts the app container.

Fresh Start (Wipe Data)

If you wipe the postgres data volume and reinitialise, the POSTGRES_PASSWORD: postgres env var in docker-compose.yml sets the initial password correctly. The pg_hba.conf trust rules then prevent any future SCRAM issues.

# Wipe all data and reinitialise
docker compose down -v
docker compose up -d --build

Checking Postgres Auth

# Connect from inside the app container
docker compose exec app sh
# Then inside the container:
psql $DATABASE_URL -c "SELECT 1"

# Or directly from the host (uses scram-sha-256)
psql -h localhost -U taskqueue -d taskqueue

Auth Rule Summary