# PostgreSQL Server Configuration Fix 🔧

## Your Error Explained

```
error: no pg_hba.conf entry for host "10.0.23.4", user "taskflow", 
database "taskflow", no encryption
```

This error means:
1. ✅ Your TaskFlow app (at IP 10.0.23.4) can reach the PostgreSQL server
2. ❌ PostgreSQL's `pg_hba.conf` file requires SSL connections (`hostssl`)
3. ❌ Your connection isn't using SSL (or SSL isn't enabled on the server)
4. ❌ PostgreSQL rejects the connection

## The Root Cause

Your PostgreSQL server has a **configuration mismatch**:

```
pg_hba.conf says:  "hostssl" (requires SSL)
postgresql.conf:    ssl = off (SSL disabled)
Result:            No connections work! ❌
```

## How to Fix (Choose ONE Option)

### ✅ Option 1: Allow Non-SSL Connections (Quickest)

This allows your TaskFlow app to connect without SSL.

**Step 1: SSH into your PostgreSQL server**

```bash
ssh your-postgres-server
```

**Step 2: Find pg_hba.conf location**

```bash
# If you have psql access
sudo -u postgres psql -c "SHOW hba_file;"

# Common locations:
# Ubuntu/Debian: /etc/postgresql/16/main/pg_hba.conf
# CentOS/RHEL:   /var/lib/pgsql/data/pg_hba.conf
# Docker:        /var/lib/postgresql/data/pg_hba.conf
```

**Step 3: Edit pg_hba.conf**

```bash
sudo nano /etc/postgresql/16/main/pg_hba.conf
```

**Step 4: Add or modify these lines**

Look for lines with `taskflow` or add new ones:

```conf
# TYPE  DATABASE   USER       ADDRESS           METHOD
host    taskflow   taskflow   10.0.23.0/24      md5
host    taskflow   taskflow   10.0.0.0/8        md5

# Or allow from any IP (less secure, for testing)
host    taskflow   taskflow   0.0.0.0/0         md5
```

**Important:** Change `hostssl` to `host` if you see it:

```conf
# BEFORE (requires SSL):
hostssl  taskflow  taskflow  10.0.0.0/8  md5

# AFTER (allows non-SSL):
host     taskflow  taskflow  10.0.0.0/8  md5
```

**Step 5: Reload PostgreSQL**

```bash
# Ubuntu/Debian
sudo systemctl reload postgresql

# CentOS/RHEL
sudo systemctl reload postgresql-16

# Docker
docker exec -it your-postgres-container pg_ctl reload

# Or via SQL
sudo -u postgres psql -c "SELECT pg_reload_conf();"
```

**Step 6: Test the connection**

```bash
# From your Docker host (where TaskFlow runs)
psql "postgresql://taskflow:your_password@your_postgres_host:5432/taskflow"
```

If this works, redeploy your TaskFlow app - it should connect now!

---

### ✅ Option 2: Enable SSL on PostgreSQL (More Secure)

If you want encrypted connections, enable SSL on your PostgreSQL server.

**Step 1: Generate SSL certificates**

```bash
# SSH into PostgreSQL server
ssh your-postgres-server

# Find PostgreSQL data directory
sudo -u postgres psql -c "SHOW data_directory;"
# Usually: /var/lib/postgresql/16/main or /var/lib/pgsql/data

cd /var/lib/postgresql/16/main  # Adjust path

# Generate self-signed certificate
sudo openssl req -new -x509 -days 365 -nodes -text \
  -out server.crt \
  -keyout server.key \
  -subj "/CN=$(hostname)"

# Set correct permissions
sudo chmod 600 server.key
sudo chown postgres:postgres server.key server.crt
```

**Step 2: Enable SSL in postgresql.conf**

```bash
sudo nano /etc/postgresql/16/main/postgresql.conf
```

Find and change:

```conf
# BEFORE:
#ssl = off

# AFTER:
ssl = on
ssl_cert_file = 'server.crt'
ssl_key_file = 'server.key'
```

**Step 3: Update pg_hba.conf**

```bash
sudo nano /etc/postgresql/16/main/pg_hba.conf
```

Ensure SSL connections are allowed:

```conf
# TYPE    DATABASE   USER       ADDRESS         METHOD
hostssl   taskflow   taskflow   10.0.0.0/8      md5
hostssl   taskflow   taskflow   0.0.0.0/0       md5
```

**Step 4: Restart PostgreSQL**

```bash
sudo systemctl restart postgresql
```

**Step 5: Update TaskFlow deployment**

Set the environment variable:

```bash
DATABASE_SSL=true
```

Then redeploy TaskFlow.

---

## Quick Diagnostic Commands

Run these on your PostgreSQL server to understand current configuration:

```bash
# Check if SSL is enabled
sudo -u postgres psql -c "SHOW ssl;"

# View pg_hba.conf
sudo cat /etc/postgresql/16/main/pg_hba.conf | grep -v "^#" | grep -v "^$"

# Check if PostgreSQL is listening
sudo netstat -tlnp | grep 5432

# Check PostgreSQL logs
sudo tail -f /var/log/postgresql/postgresql-16-main.log
```

## Verification Steps

After making changes:

**1. Test from PostgreSQL server itself:**

```bash
psql -U taskflow -d taskflow -h localhost
```

**2. Test from Docker host (where TaskFlow runs):**

```bash
# Replace with your actual values
psql "postgresql://taskflow:password@your-postgres-host:5432/taskflow"
```

**3. Check TaskFlow app logs:**

```bash
docker-compose logs -f app
```

You should see:
```
serving on port 5000
Checking database schema...
✓ Database schema is up to date
✓ Database initialized successfully
```

## Common Mistakes to Avoid

❌ **Editing pg_hba.conf without reloading**
→ Changes only take effect after `pg_ctl reload` or `systemctl reload postgresql`

❌ **Using hostssl when SSL is disabled**
→ Use `host` instead of `hostssl` if `ssl = off`

❌ **Forgetting to restart after enabling SSL**
→ Enabling SSL requires full restart: `systemctl restart postgresql`

❌ **Wrong IP address range**
→ Use `10.0.0.0/8` or specific subnet like `10.0.23.0/24`

## Recommended Quick Fix

**For fastest deployment**, I recommend **Option 1** (allow non-SSL):

```bash
# 1. Edit pg_hba.conf
sudo nano /etc/postgresql/16/main/pg_hba.conf

# 2. Add this line (or change hostssl to host)
host    taskflow   taskflow   10.0.0.0/8   md5

# 3. Reload
sudo systemctl reload postgresql

# 4. Test
psql "postgresql://taskflow:password@your-host:5432/taskflow"
```

## Example pg_hba.conf

A complete working example:

```conf
# TYPE  DATABASE        USER            ADDRESS                 METHOD

# Local connections
local   all             postgres                                peer
local   all             all                                     peer

# IPv4 local connections
host    all             all             127.0.0.1/32            md5

# TaskFlow application connections (no SSL required)
host    taskflow        taskflow        10.0.0.0/8              md5
host    taskflow        taskflow        0.0.0.0/0               md5

# IPv6 local connections
host    all             all             ::1/128                 md5
```

## If You're Using Cloud PostgreSQL

### AWS RDS
- Cannot edit pg_hba.conf directly
- Must use SSL or disable `rds.force_ssl` parameter
- Set `DATABASE_SSL=true` in TaskFlow

### Azure PostgreSQL
- Requires SSL by default
- Set `DATABASE_SSL=true` in TaskFlow

### DigitalOcean
- Requires SSL for external connections
- Set `DATABASE_SSL=true` in TaskFlow

### Google Cloud SQL
- Requires SSL or authorized networks
- Set `DATABASE_SSL=true` in TaskFlow

---

## Your TaskFlow Application is Ready! ✅

The TaskFlow application code is **production-ready** and correctly configured. The only remaining issue is the PostgreSQL server configuration.

Once you fix pg_hba.conf on your PostgreSQL server, everything will work perfectly!

**Next Step:** Choose Option 1 or Option 2 above and apply the fix to your PostgreSQL server.