Re: Where do pg_hba.conf include files live?

Tom Lane wrote:
> The SGML docs state that include files referenced by "@foo" constructs
> in pg_hba.conf "must be in the same directory as pg_hba.conf". The
> actual implementation, however, assumes they must be in DataDir.
> This is no longer the same thing after the introduction of the
> data_directory and hba_file GUC parameters.
>
> It seems to me that in a context where you are storing pg_hba.conf in a
> separate configuration directory, putting the include files in that same
> directory is the behavior you'd want. On the other hand, the contents
> of those files would often be data-cluster-specific (since they'd
> typically be lists of user or database names). Maybe the code behavior
> is still sensible.
>
> One thing that's probably *not* sensible either way is that the code
> forcibly prepends the directory name even if it's fed "@/abs/path".
> I think if an absolute path is given it should be honored. That would
> give an "out" for DBAs who want whichever behavior we don't provide.
>
> The changes to fix the code, if we decide the code is wrong rather than
> the docs, do not look very large; so I don't think we need to decide
> this on the basis of it being too late to change for 8.0.

Good point. I agree @ should be relative to pg_hba.conf directory and
not datadir, and that absolute paths should work.

--
Bruce Momjian | http://candle.pha.pa.us
pgman(at)candle(dot)pha(dot)pa(dot)us | (610) 359-1001
+ If your life is a hard drive, | 13 Roberts Road
+ Christ can be your backup. | Newtown Square, Pennsylvania 19073