Hello I'm trying to figure out the best way to allow connection from certain ips/hosts to my db instance.
I've got an api(s) pointing to the database and right now we do something like this (pg_hba.conf) :
host prod_db prod_user xxx.xxx.77.xx/32 password
And since the api are getting deployed in cloud and with new instances, having new ips, we kind of change this config every time we deploy, which is not very good, cause we have to restart the db server and therefore have to put the whole eco system in the maintenance mode.
I'm just reading this :
This bit looks appealing to me:
# Allow any user from hosts in the example.com domain to connect to # any database if the user's password is correctly supplied. # # TYPE DATABASE USER ADDRESS METHOD host all all .example.com md5
So this means any incoming connection from
api1.example.com or any from this domain will be accepted if the password is correct.
But my question is how does the db server know that it's coming from the
Does this mean that the server is doing some kind of reverse dns lookup before allowing connection?
Does this assume that example address
123.456.22.11 which points to
api.example.com, by point I mean A record will be allowed connection from or how this works?
What do I need to do to make this work?
My ultimate goal is not to have to edit the
pg_hba.conf every time there is a new api server instance booted up to add that new ip. And not having to restart postgres db instance