# moments — pg_ident.conf.d drop-in template
# Maintained by script/db-perms.sh (idempotent; run from a workstation).
# Install path: /var/lib/pgsql/18/data/pg_ident.conf.d/moments.conf
#
# The file is named for the app (moments.conf), NOT the cert_cn host, so
# provisioning for other apps — which may own drop-ins for the same hosts —
# can never clobber or interleave with moments access.
#
# Apply with: sudo systemctl reload postgresql-18 — on BOTH magrathea
# (primary) and frankie (standby) so failover doesn't lock the app out.
#
# One line per (cert_cn host, role) mapping. A host that runs both
# moments-api and moments-worker will have two lines (one for moments_ro,
# one for moments_rw).

cert_cn {{HOST_FQDN}} {{DB_ROLE}}