From 950b16386926b85673a4676588815f804dfd5b8c Mon Sep 17 00:00:00 2001
From: h7x4 <h7x4@nani.wtf>
Date: Tue, 21 Jul 2026 16:32:49 +0900
Subject: [PATCH] bicep/postgresql: use scram-sha-256 as default password
 algorithm

---
 hosts/bicep/services/postgresql/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/hosts/bicep/services/postgresql/default.nix b/hosts/bicep/services/postgresql/default.nix
index 2ae2429..e48d599 100644
--- a/hosts/bicep/services/postgresql/default.nix
+++ b/hosts/bicep/services/postgresql/default.nix
@@ -14,6 +14,7 @@ in
     extensions = ps: with ps; [ pg_repack ];
     enableTCPIP = true;
 
+    # NOTE: md5 accepts both md5 and scram-sha-256
     authentication = ''
       host all all ${values.ipv4-space} md5
       host all all ${values.ipv6-space} md5
@@ -76,6 +77,9 @@ in
       maintenance_io_concurrency = 100;
       wal_recycle = true;
 
+      # Authentication
+      password_encryption = "scram-sha-256";
+
       # SSL
       ssl = true;
       ssl_cert_file = "/run/credentials/postgresql.service/cert";