fix: resolve PostgreSQL connection authentication error

- Fix "no pg_hba.conf entry" error by disabling SSL for Docker network
- Use scram-sha-256 authentication method for better security
- Update knexfile.js to support SSL configuration via environment variable
- Add documentation about PostgreSQL connection requirements

The PostgreSQL container now accepts connections from the Docker network
without requiring SSL, which is appropriate for internal container communication.

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

PRODUCTION_DEPLOYMENT_FIXES.md

@@ -81,4 +81,20 @@ Expected response:
 Email service requires configuration in the database. If email is not configured:
 - The service will log a warning but continue running
 - Emails will be queued but not sent
-- Configure email settings in the admin panel after deployment
+- Configure email settings in the admin panel after deployment
+
+## PostgreSQL Connection Fix
+
+### Issue: "no pg_hba.conf entry for host"
+This error occurs when PostgreSQL requires SSL but the client connects without encryption.
+
+### Solution:
+- Disabled SSL requirement for PostgreSQL in Docker environment (`ssl=off`)
+- Added proper authentication method (`scram-sha-256`)
+- This is acceptable for internal Docker networks where all traffic is isolated
+
+### Security Note:
+For production deployments exposed to the internet:
+1. Use SSL certificates for PostgreSQL
+2. Or ensure the database is only accessible within the Docker network
+3. Never expose PostgreSQL port (5432) directly to the internet

backend/knexfile.js

@@ -31,7 +31,8 @@ const config = {
       port: process.env.DB_PORT || 5432,
       user: process.env.DB_USER || 'picpeak',
       password: process.env.DB_PASSWORD,
-      database: process.env.DB_NAME || 'picpeak'
+      database: process.env.DB_NAME || 'picpeak',
+      ssl: process.env.DB_SSL === 'true' ? { rejectUnauthorized: false } : false
     },
     pool: {
       min: 2,

docker-compose.prod.yml

@@ -88,10 +88,15 @@ services:
       - POSTGRES_USER=${DB_USER:-picpeak}
       - POSTGRES_PASSWORD=${DB_PASSWORD}
       - POSTGRES_DB=${DB_NAME:-picpeak}
+      # Allow connections from any host with password authentication
+      - POSTGRES_HOST_AUTH_METHOD=scram-sha-256
+      - POSTGRES_INITDB_ARGS=--auth-host=scram-sha-256 --auth-local=trust
     volumes:
       - postgres_data:/var/lib/postgresql/data
     networks:
       - picpeak
+    # Allow connections without SSL requirement from Docker network
+    command: postgres -c ssl=off
 
   umami:
     image: ghcr.io/umami-software/umami:postgresql-latest