MIME-Version: 1.0
References: 
 <CAN4CZFNXdKL4eb_GwT_h-vUuUV+CbPCk_8-+S3kV8iFmNmUw7A@mail.gmail.com>
 <DJSICZEWRJBC.XT5U5929XT0N@partin.io>
 <CAD5tBc+ki9ynMuFRkFCCXVtyOO7HaEU7EEdGKA1LWgofNgdNOQ@mail.gmail.com>
 <CAOYmi+m8PrWyhY7diTA+UTGNNzQ8eCZZLRA07LTuzj4VCBaudA@mail.gmail.com>
 <CAN4CZFPQiNvfX2k35zYi9eZ7-kC5vEeQtiM_nOce3MNpK4Ai_w@mail.gmail.com>
In-Reply-To: 
 <CAN4CZFPQiNvfX2k35zYi9eZ7-kC5vEeQtiM_nOce3MNpK4Ai_w@mail.gmail.com>
From: Jacob Champion <jacob.champion@enterprisedb.com>
Date: Thu, 9 Jul 2026 15:48:37 -0700
Message-ID: 
 <CAOYmi+nxQwwkmb5NEj_LUS6ZCstWqyM-Do3KbqdV9JW3YmwbWA@mail.gmail.com>
Subject: Re: Proposal: new file format for hba/ident/hosts configuration?
To: Zsolt Parragi <zsolt.parragi@percona.com>
Cc: Andrew Dunstan <andrew@dunslane.net>, Tristan Partin <tristan@partin.io>,
	PostgreSQL Hackers <pgsql-hackers@lists.postgresql.org>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Archived-At: 
 <https://www.postgresql.org/message-id/CAOYmi%2BnxQwwkmb5NEj_LUS6ZCstWqyM-Do3KbqdV9JW3YmwbWA%40mail.gmail.com>
Precedence: bulk

On Wed, Jul 8, 2026 at 8:33=E2=80=AFAM Zsolt Parragi <zsolt.parragi@percona=
.com> wrote:
> I focused on TOML in my email because I think that's still a better
> configuration format than JSON5.

(I agree)

> * do we agree on working towards another configuration format?
> * if yes, what requirements do we have for it?
> * what exact issues do we want to solve, and what to leave as non-goals?

Adding small pieces to this pile: I'm primarily motivated by authn/z,
and I'd like to be able to more intuitively attach parameters to
certain connection contexts. This is something that neither a flat
configuration, nor separated tabular configurations, have really
helped us with.

"Connections using SCRAM authentication should time out in X seconds
instead of the default." Or "this group of users should use the
following list of GUCs." The sample I used in [1] a long time ago was

    Everyone has to use LDAP auth
    With this server
    And these TLS settings

    Except admins
        who additionally need client certificates
        with this CA root

    And Jacob
        who isn't allowed in anymore

We don't handle these (perfectly reasonable IMO) cases very well, or
sometimes at all. I'm primarily used to servers in the web space
(httpd, nginx, caddy, haproxy) when it comes to this configuration
style, which I think I called "contexts with property bags" in that
other thread.

> * I am unsure about using the array syntax for hba rules, but so far I
> like it better than the alternative ideas I tried

FWIW I find that part of it pretty hard to read and understand, though
that should not in any way spike the general concept into the ground.

Thanks!
--Jacob

[1] https://postgr.es/m/0e0c038ab962c3f6dab00934fe5ae1ae115f44c0.camel%40vm=
ware.com