PostgreSQL "no pg_hba.conf entry for host": allow this connection, the safe way

1. Read the message

Each part of it maps to a column:

The address is worth a second look: behind a NAT, a proxy or Docker, it’s not the one you’d guess.

2. Find and edit the file

sudo -u postgres psql -c 'SHOW hba_file;'

It’s usually /etc/postgresql/18/main/pg_hba.conf on Ubuntu and Debian, and /var/lib/pgsql/18/data/pg_hba.conf on RHEL. Add your rule:

# TYPE  DATABASE  USER  ADDRESS          METHOD
host    shop      app   10.0.0.20/32     scram-sha-256
host    shop      app   10.0.1.0/24      scram-sha-256

/32 means one address, and /24 a whole subnet of 256. The Subnet Calculator works these out.

The order matters. PostgreSQL uses the first line that matches, and doesn’t read further. A broad reject line above yours wins, so put yours before it.

Reload, which doesn’t drop anyone’s connection:

sudo systemctl reload postgresql

Check it, as a typo makes a line invalid without much noise:

SELECT line_number, type, database, user_name, address, auth_method, error
FROM pg_hba_file_rules;

The error column shows lines PostgreSQL couldn’t read.

3. The type: SSL or not

FATAL:  no pg_hba.conf entry for host "10.0.0.20", user "app", database "shop", no encryption

The type column decides which connections a line covers:

So if only hostssl lines exist, then the fix is on the client, which should use TLS, rather than a new rule. This is the usual case on managed services, where you can’t edit the file anyway:

psql "host=10.0.0.5 dbname=shop user=app sslmode=require"

In a connection string, that’s postgresql://app:pass@10.0.0.5/shop?sslmode=require. On Amazon RDS, rds.force_ssl does this, and its message says no encryption. On RDS the file is managed for you, and you control access with security groups and parameter groups.

4. Other values that don’t match

• host "::1": an IPv6 connection to localhost. You need a line for ::1/128, or connect to 127.0.0.1 instead.
• A name in place of an address: use the address, or a domain with a leading dot such as .example.com, which needs working reverse DNS and is slower.
• database "replication": that’s a special word for replicas, and it needs its own line. all doesn’t include it.

5. Docker

Containers come from a changing address on a Docker network, often 172.18.0.x. The official image allows others by default with a line like this one:

host all all all scram-sha-256

So if you see this error there, your data folder has an older or edited file. Don’t guess: docker exec db cat /var/lib/postgresql/data/pg_hba.conf. On version 18 images, the data folder moved, so use docker exec db psql -U postgres -c 'SHOW hba_file;' to check. Then allow the Docker network as narrowly as you can. The file lives in the volume, so it survives recreating the container, and POSTGRES_HOST_AUTH_METHOD only applies on first start.

6. After you’ve fixed it

A different message means you’ve moved forward:

• password authentication failed for user: a rule matches now, and the password’s wrong.
• Peer authentication failed: a peer rule matched.
• Connection refused means this wasn’t really your problem: see PostgreSQL connection refused.

Set a strong password with the Password Generator, and check the Port Lookup for why 5432 shouldn’t be public.