From d85483490a7f4a306a6ee39d8eb5b3944d0f4512 Mon Sep 17 00:00:00 2001
From: Roy Dumblauskas <roydumblauskas@gmail.com>
Date: Sun, 23 Nov 2025 19:01:32 -0600
Subject: [PATCH] granular role access

---
 homelab-services/postgresql-db/flake.nix | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/homelab-services/postgresql-db/flake.nix b/homelab-services/postgresql-db/flake.nix
index b6910d9..a85b76b 100644
--- a/homelab-services/postgresql-db/flake.nix
+++ b/homelab-services/postgresql-db/flake.nix
@@ -65,8 +65,12 @@
           '';
 
           # allow remote connections to dev databases
-          authentication = ''
-            ${lib.concatStringsSep " " (map (db: "host ${db}_dev ${db}_devuser 10.0.0.141/24 md5\n") opts.databases) }
+          authentication = pkgs.lib.mkOverride 10 ''
+            local all postgres peer map=postgres
+            local all all peer
+
+            # Dev can be connected to via the LAN, Prod only via localhost
+            ${lib.concatStringsSep " " (map (db: "host ${db}_dev ${db}_devuser samenet md5\n") opts.databases) }
             ${lib.concatStringsSep " " (map (db: "local ${db} ${db}_produser md5\n") opts.databases) }
           '';
         };