From 07b0c89df648294b58186d3cb7dcdf9504ed4da5 Mon Sep 17 00:00:00 2001
From: hectorzhao <hectorzhao@example.com>
Date: Tue, 7 Jul 2026 15:23:41 +0800
Subject: [PATCH] fix: configure postgres password auth in bootstrap

---
 tools/deploy/production-bootstrap.sh | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/tools/deploy/production-bootstrap.sh b/tools/deploy/production-bootstrap.sh
index 35be498..e0e3b06 100644
--- a/tools/deploy/production-bootstrap.sh
+++ b/tools/deploy/production-bootstrap.sh
@@ -143,6 +143,22 @@ SELECT 'CREATE DATABASE ${DB_NAME} OWNER ${DB_USER}'
 WHERE NOT EXISTS (SELECT FROM pg_database WHERE datname = '${DB_NAME}')\\gexec
 ALTER DATABASE ${DB_NAME} OWNER TO ${DB_USER};
 SQL
+  local hba_file
+  hba_file="$(runuser -u postgres -- psql -Atc 'SHOW hba_file;')"
+  if [[ -n "$hba_file" ]] && ! grep -q "CMPP platform local access" "$hba_file"; then
+    log "Configuring PostgreSQL local password authentication"
+    cp "$hba_file" "${hba_file}.bak.$(date +%Y%m%d%H%M%S)"
+    {
+      echo "# CMPP platform local access"
+      echo "host    ${DB_NAME}    ${DB_USER}    127.0.0.1/32    scram-sha-256"
+      echo "host    ${DB_NAME}    ${DB_USER}    ::1/128         scram-sha-256"
+      cat "$hba_file"
+    } >"${hba_file}.tmp"
+    mv "${hba_file}.tmp" "$hba_file"
+    chown postgres:postgres "$hba_file"
+    chmod 600 "$hba_file"
+  fi
+  systemctl reload postgresql || systemctl reload postgresql.service
 }
 
 write_env() {