example.users.toml

#:schema ./.schema/users.schema.json
#
# Basic users configuration.
#
[[users]]
name = "pgdog"
database = "pgdog"
password = "pgdog"

[[users]]
name = "pgdog"
database = "pgdog_sharded"
password = "pgdog"

# Example: backend authentication with AWS RDS IAM token generation.
# PgDog still authenticates the client as configured by `general.auth_type`;
# this only affects how PgDog authenticates to PostgreSQL servers.
# server_auth = "rds_iam"
# server_iam_region = "us-east-1" # optional; auto-inferred from RDS hostname when omitted

# Example: backend authentication with Azure Workload Identity token generation.
# PgDog still authenticates the client as configured by `general.auth_type`;
# this only affects how PgDog authenticates to PostgreSQL servers.
# server_auth = "azure_workload_identiy"

# Example: backend authentication with HashiCorp Vault dynamic credentials.
# Requires the [vault] section in pgdog.toml. PgDog fetches a generated
# username and password from `server_vault_path` and rotates them after
# `vault_refresh_percent` of the lease has elapsed.
# server_auth = "vault_dynamic"
# server_vault_path = "database/creds/pgdog"
# vault_refresh_percent = 80 # optional; default 80

# Example: client authentication against a HashiCorp Vault static database role.
# Requires the [vault] section in pgdog.toml. PgDog verifies the password the
# client sends against Vault's current password for the static role at `vault_path`,
# instead of a statically configured password.
# Independent of `server_auth` below; combine it with any backend authentication method.
# vault_path = "database/static-creds/alice"

# Example: backend authentication with a HashiCorp Vault static role.
# Requires the [vault] section in pgdog.toml.
# server_user = "pgdog_service"
# server_auth = "vault_static"
# server_vault_path = "database/static-creds/pgdog-service"