; pgBouncer userlist.txt — SCRAM-SHA-256 password hashes
;
; IMPORTANT: this file is a template.  Replace the placeholder values with
; real SCRAM-SHA-256 hashes before deploying.  Never commit real passwords.
;
; NOTE: this repo's compose `prod`-profile pgbouncer service
; (deploy/docker/docker-compose.yml) does NOT read this file — it sets
; AUTH_TYPE=trust (no SCRAM userlist check) and mounts no userlist.txt at
; all. This template documents the SCRAM/userlist workflow for a standalone
; (non-compose) pgBouncer deployment; see deploy/docker/README-pgbouncer.md.
;
; Generating SCRAM-SHA-256 hashes
; --------------------------------
; 1. Connect to Postgres as a superuser and create the role:
;
;      CREATE ROLE novafabric_app WITH LOGIN PASSWORD 'your-strong-password';
;      CREATE ROLE novafabric_migrator WITH LOGIN PASSWORD 'another-strong-password';
;
;    Postgres automatically stores these as SCRAM-SHA-256 hashes when
;    password_encryption = scram-sha-256 (the default in Postgres 14+).
;
; 2. Retrieve the stored hash:
;
;      SELECT rolname, rolpassword FROM pg_authid
;        WHERE rolname IN ('novafabric_app', 'novafabric_migrator');
;
;    The rolpassword column contains the full SCRAM-SHA-256 string of the form:
;      SCRAM-SHA-256$<iterations>:<base64-salt>$<base64-stored-key>:<base64-server-key>
;
; 3. Place it in this file (including the double-quotes):
;
;      "novafabric_app" "SCRAM-SHA-256$4096:<salt>$<stored-key>:<server-key>"
;
; Security notes
; --------------
; - The compose `prod`-profile pgbouncer service configures itself from
;   environment variables and does NOT mount this file (see
;   deploy/docker/README-pgbouncer.md). If you run pgBouncer standalone
;   (outside that compose stack), mount this file read-only instead:
;     volumes:
;       - ./pgbouncer-userlist.txt:/etc/pgbouncer/userlist.txt:ro
; - Rotate passwords by updating this file and reloading pgBouncer (standalone
;   deployments only — see the NOTE above; for this repo's compose service,
;   edit `environment:` in docker-compose.yml and recreate the container
;   instead: `docker compose --profile prod up -d --force-recreate pgbouncer`):
;     docker compose exec pgbouncer pgbouncer -R /etc/pgbouncer/pgbouncer.ini
; - Do NOT use md5 or plaintext passwords in production.

"novafabric_app"      "SCRAM-SHA-256$<iterations>:<salt>$<stored-key>:<server-key>"
"novafabric_migrator" "SCRAM-SHA-256$<iterations>:<salt>$<stored-key>:<server-key>"
"pgbouncer_admin"     "SCRAM-SHA-256$<iterations>:<salt>$<stored-key>:<server-key>"
"pgbouncer_stats"     "SCRAM-SHA-256$<iterations>:<salt>$<stored-key>:<server-key>"
