Adjust POSTGRES_HOST_AUTH_METHOD to automatically match configured password_encryption

[yosifkit]

this release now makes the standards-compliant SCRAM-SHA-256 password management and authentication system the default on new PostgreSQL instances

https://www.postgresql.org/about/news/postgresql-14-released-2318/

With the swap to scram-sha-256 as the default, initdb uses that unless specified otherwise. So for the initial user created, the password is SCRAM encrypted.

To ease transition from the md5 method to the newer SCRAM method, if md5 is specified as a method in pg_hba.conf but the user's password on the server is encrypted for SCRAM (see below), then SCRAM-based authentication will automatically be chosen instead.

https://www.postgresql.org/docs/14/auth-password.html
See #895 (comment)

So, the current md5 in the host auth method will use scram-sha-256 if that is how the password was saved.

---

With this change on postgres:14, the host auth method in pg_hba.conf will reflect the change to scram-sha-256 instead of using md5. But there is the possibility of breaking users that are using a pre-hashed md5 password and are starting a newly initialized PostgreSQL 14 container.

This change makes it possible to change the initial auth and have pg_hba.conf reflect the change automatically by using POSTGRES_INITDB_ARGS=--auth-host=scram-sha-256 and not having to also set POSTGRES_HOST_AUTH_METHOD.

Setting -c password_encryption=md5 is not enough to affect the initial user created by initdb (even though it is passed along to initdb 😢).

Our POSTGRES_HOST_AUTH_METHOD variable still only effects the line in pg_hba.conf.

[yosifkit]

A table showing which values override which and where. The major difference from the current images, is that
POSTGRES_INITDB_ARGS=--auth-host= and password_encryption= via the command line can change the line that the entrypoint adds to pg_hba.conf.

password_encryption in a postgresql.conf that is used/seen by initdb should be equivalent to POSTGRES_INITDB_ARGS.

Affected users/file ➡️ Settings supplied ⬇️	Initial postgres user	pg_hba.conf	new users
POSTGRES_INITDB_ARGS=--auth-host=initValue	initValue	initValue	initValue
POSTGRES_HOST_AUTH_METHOD=authValue	default	authValue	default
-c password_encryption=encValue	default	encValue	encValue
POSTGRES_INITDB_ARGS=--auth-host=initValue POSTGRES_HOST_AUTH_METHOD=authValue	initValue	authValue	initValue
POSTGRES_HOST_AUTH_METHOD=authValue -c password_encryption=encValue	default	authValue	encValue
POSTGRES_INITDB_ARGS=--auth-host=initValue -c password_encryption=encValue	initValue	encValue	encValue
POSTGRES_INITDB_ARGS=--auth-host=initValue POSTGRES_HOST_AUTH_METHOD=authValue -c password_encryption=encValue	initValue	authValue	encValue

[tianon]

😍