[Fixes #13894] Expose PostgreSQL configuration files on host for tuning in GeoNode Docker setup

docker-compose.yml

@@ -131,13 +131,19 @@ services:
   db:
     # use geonode official postgis 15 image
     image: geonode/postgis:15-3.5-latest
-    command: postgres -c "max_connections=${POSTGRESQL_MAX_CONNECTIONS}"
+    command:
+      - postgres
+      - -c
+      - config_file=/etc/postgresql/postgresql.conf
     container_name: db4${COMPOSE_PROJECT_NAME}
     env_file:
       - .env
     volumes:
       - dbdata:/var/lib/postgresql/data
       - dbbackups:/pg_backups
+      - ./docker/postgresql/postgresql.conf:/etc/postgresql/postgresql.conf:ro
+      - ./docker/postgresql/conf.d:/etc/postgresql/conf.d:ro
+      - ./docker/postgresql/pg_hba.conf:/etc/postgresql/pg_hba.conf:ro
     restart: unless-stopped
     healthcheck:
       test: "pg_isready -d postgres -U postgres"

docker/postgresql/pg_hba.conf

@@ -0,0 +1,39 @@
+# Local Unix socket connections - trust for local admin access
+local   all             postgres                                trust
+
+# Localhost connections - trust for container internal access
+host    all             postgres        127.0.0.1/32            trust
+host    all             postgres        ::1/128                 trust
+
+# Allow replication connections from localhost
+local   replication     all                                     trust
+host    replication     all             127.0.0.1/32            trust
+host    replication     all             ::1/128                 trust
+
+# =============================================================================
+# Application-specific rules (evaluated in order)
+# =============================================================================
+
+# GeoNode database - require SCRAM-SHA-256 authentication
+# This matches connections from Django/Celery containers
+host    geonode         geonode         172.19.0.0/16           scram-sha-256
+
+# GeoNode geodatabase - require SCRAM-SHA-256 authentication
+# This matches connections from GeoServer
+host    geonode_data    geonode_data    172.19.0.0/16           scram-sha-256
+
+# Template databases - no external access allowed
+host    template0       all             all                     reject
+host    template1       all             all                     reject
+
+# Postgres database - admin only, require password
+host    postgres        postgres        172.19.0.0/16           scram-sha-256
+
+# =============================================================================
+# Default catch-all rule - deny all other connections
+# =============================================================================
+# Uncomment to explicitly deny all other connections:
+# host    all             all             all                     reject
+
+# Or allow with password (current default):
+host    all             all             all                     scram-sha-256

docker/postgresql/postgresql.conf

@@ -0,0 +1,13 @@
+# Data Directory (managed by Docker)
+data_directory = '/var/lib/postgresql/data'
+
+# Connection Settings
+listen_addresses = '*'  # Listen on all network interfaces
+
+# Authentication Configuration File
+hba_file = '/etc/postgresql/pg_hba.conf'
+
+# Include additional configuration files from conf.d directory
+# All .conf files in this directory will be processed
+include_dir = 'conf.d'
+