task-manager/POSTGRESQL-SERVER-FIX-GUIDE.md

PostgreSQL Server Configuration Fix 🔧

Your Error Explained

error: no pg_hba.conf entry for host "10.0.23.4", user "taskflow", 
database "taskflow", no encryption

This error means:

1. ✅ Your TaskFlow app (at IP 10.0.23.4) can reach the PostgreSQL server
2. ❌ PostgreSQL's pg_hba.conf file requires SSL connections (hostssl)
3. ❌ Your connection isn't using SSL (or SSL isn't enabled on the server)
4. ❌ PostgreSQL rejects the connection

The Root Cause

Your PostgreSQL server has a configuration mismatch:

pg_hba.conf says:  "hostssl" (requires SSL)
postgresql.conf:    ssl = off (SSL disabled)
Result:            No connections work! ❌

How to Fix (Choose ONE Option)

✅ Option 1: Allow Non-SSL Connections (Quickest)

This allows your TaskFlow app to connect without SSL.

Step 1: SSH into your PostgreSQL server

ssh your-postgres-server

Step 2: Find pg_hba.conf location

# If you have psql access
sudo -u postgres psql -c "SHOW hba_file;"

# Common locations:
# Ubuntu/Debian: /etc/postgresql/16/main/pg_hba.conf
# CentOS/RHEL:   /var/lib/pgsql/data/pg_hba.conf
# Docker:        /var/lib/postgresql/data/pg_hba.conf

Step 3: Edit pg_hba.conf

sudo nano /etc/postgresql/16/main/pg_hba.conf

Step 4: Add or modify these lines

Look for lines with taskflow or add new ones:

# TYPE  DATABASE   USER       ADDRESS           METHOD
host    taskflow   taskflow   10.0.23.0/24      md5
host    taskflow   taskflow   10.0.0.0/8        md5

# Or allow from any IP (less secure, for testing)
host    taskflow   taskflow   0.0.0.0/0         md5

Important: Change hostssl to host if you see it:

# BEFORE (requires SSL):
hostssl  taskflow  taskflow  10.0.0.0/8  md5

# AFTER (allows non-SSL):
host     taskflow  taskflow  10.0.0.0/8  md5

Step 5: Reload PostgreSQL

# Ubuntu/Debian
sudo systemctl reload postgresql

# CentOS/RHEL
sudo systemctl reload postgresql-16

# Docker
docker exec -it your-postgres-container pg_ctl reload

# Or via SQL
sudo -u postgres psql -c "SELECT pg_reload_conf();"

Step 6: Test the connection

# From your Docker host (where TaskFlow runs)
psql "postgresql://taskflow:your_password@your_postgres_host:5432/taskflow"

If this works, redeploy your TaskFlow app - it should connect now!

---

✅ Option 2: Enable SSL on PostgreSQL (More Secure)

If you want encrypted connections, enable SSL on your PostgreSQL server.

Step 1: Generate SSL certificates

# SSH into PostgreSQL server
ssh your-postgres-server

# Find PostgreSQL data directory
sudo -u postgres psql -c "SHOW data_directory;"
# Usually: /var/lib/postgresql/16/main or /var/lib/pgsql/data

cd /var/lib/postgresql/16/main  # Adjust path

# Generate self-signed certificate
sudo openssl req -new -x509 -days 365 -nodes -text \
  -out server.crt \
  -keyout server.key \
  -subj "/CN=$(hostname)"

# Set correct permissions
sudo chmod 600 server.key
sudo chown postgres:postgres server.key server.crt

Step 2: Enable SSL in postgresql.conf

sudo nano /etc/postgresql/16/main/postgresql.conf

Find and change:

# BEFORE:
#ssl = off

# AFTER:
ssl = on
ssl_cert_file = 'server.crt'
ssl_key_file = 'server.key'

Step 3: Update pg_hba.conf

sudo nano /etc/postgresql/16/main/pg_hba.conf

Ensure SSL connections are allowed:

# TYPE    DATABASE   USER       ADDRESS         METHOD
hostssl   taskflow   taskflow   10.0.0.0/8      md5
hostssl   taskflow   taskflow   0.0.0.0/0       md5

Step 4: Restart PostgreSQL

sudo systemctl restart postgresql

Step 5: Update TaskFlow deployment

Set the environment variable:

DATABASE_SSL=true

Then redeploy TaskFlow.

---

Quick Diagnostic Commands

Run these on your PostgreSQL server to understand current configuration:

# Check if SSL is enabled
sudo -u postgres psql -c "SHOW ssl;"

# View pg_hba.conf
sudo cat /etc/postgresql/16/main/pg_hba.conf | grep -v "^#" | grep -v "^$"

# Check if PostgreSQL is listening
sudo netstat -tlnp | grep 5432

# Check PostgreSQL logs
sudo tail -f /var/log/postgresql/postgresql-16-main.log

Verification Steps

After making changes:

1. Test from PostgreSQL server itself:

psql -U taskflow -d taskflow -h localhost

2. Test from Docker host (where TaskFlow runs):

# Replace with your actual values
psql "postgresql://taskflow:password@your-postgres-host:5432/taskflow"

3. Check TaskFlow app logs:

docker-compose logs -f app

You should see:

serving on port 5000
Checking database schema...
✓ Database schema is up to date
✓ Database initialized successfully

Common Mistakes to Avoid

❌ Editing pg_hba.conf without reloading → Changes only take effect after pg_ctl reload or systemctl reload postgresql

❌ Using hostssl when SSL is disabled → Use host instead of hostssl if ssl = off

❌ Forgetting to restart after enabling SSL → Enabling SSL requires full restart: systemctl restart postgresql

❌ Wrong IP address range → Use 10.0.0.0/8 or specific subnet like 10.0.23.0/24

Recommended Quick Fix

For fastest deployment, I recommend Option 1 (allow non-SSL):

# 1. Edit pg_hba.conf
sudo nano /etc/postgresql/16/main/pg_hba.conf

# 2. Add this line (or change hostssl to host)
host    taskflow   taskflow   10.0.0.0/8   md5

# 3. Reload
sudo systemctl reload postgresql

# 4. Test
psql "postgresql://taskflow:password@your-host:5432/taskflow"

Example pg_hba.conf

A complete working example:

# TYPE  DATABASE        USER            ADDRESS                 METHOD

# Local connections
local   all             postgres                                peer
local   all             all                                     peer

# IPv4 local connections
host    all             all             127.0.0.1/32            md5

# TaskFlow application connections (no SSL required)
host    taskflow        taskflow        10.0.0.0/8              md5
host    taskflow        taskflow        0.0.0.0/0               md5

# IPv6 local connections
host    all             all             ::1/128                 md5

If You're Using Cloud PostgreSQL

AWS RDS

• Cannot edit pg_hba.conf directly
• Must use SSL or disable rds.force_ssl parameter
• Set DATABASE_SSL=true in TaskFlow

Azure PostgreSQL

• Requires SSL by default
• Set DATABASE_SSL=true in TaskFlow

DigitalOcean

• Requires SSL for external connections
• Set DATABASE_SSL=true in TaskFlow

Google Cloud SQL

• Requires SSL or authorized networks
• Set DATABASE_SSL=true in TaskFlow

---

Your TaskFlow Application is Ready! ✅

The TaskFlow application code is production-ready and correctly configured. The only remaining issue is the PostgreSQL server configuration.

Once you fix pg_hba.conf on your PostgreSQL server, everything will work perfectly!

Next Step: Choose Option 1 or Option 2 above and apply the fix to your PostgreSQL server.