Title: PostGIS plain Fly app — password auth fails over .internal network but works locally (likely pg_hba.conf)
I run PostGIS as a plain Fly app (not Managed Postgres) using the official postgis/postgis:17-3.5 Docker image, alongside a separate Phoenix app that connects to it over the Fly private network.
A previous nxdomain DNS issue was fixed by enabling IPv6 (ECTO_IPV6=true) — that resolved cleanly. Thank you to whoever helped with that.
Now that the connection actually reaches Postgres, I get:
Postgrex.Error) FATAL 28P01 (invalid_password) password authentication failed for user "amouraos"
The credentials are confirmed correct — connecting locally on the database machine itself succeeds:
fly machine exec d8de560a2d1308 "psql postgresql://amouraos:postgres2026@localhost:5432/amouraos_prod -c 'SELECT current_user;'" --app amouraos-postgis
Returns current_user: amouraos successfully.
But the same exact credentials fail when the main app connects remotely over the private network via amouraos-postgis.internal:5432. DATABASE_URL is:
postgres://amouraos:postgres2026@amouraos-postgis.internal:5432/amouraos_prod
App details:
- Main app: amouraos (Phoenix/Elixir)
- DB app: amouraos-postgis (postgis/postgis:17-3.5)
- Both apps same org, region iad
- IPv6 enabled on main app
My suspicion is pg_hba.conf only trusts local/127.0.0.1 connections by default and rejects connections arriving over the Fly private IPv6 network — which Postgres may report as the misleading invalid_password error rather than a clearer host-based rejection.
Is there a standard pg_hba.conf fix needed for this image to accept connections over .internal? Or is there a recommended approach for running PostGIS as a plain Fly app rather than Managed Postgres?