PostGIS plain Fly app rejects password over .internal, pg_hba.conf issue?

[Amouraos]

Postgres auth fails over the private network even though the same password works locally on the DB machine itself. Looking for the right pg_hba.conf fix for a plain Fly Postgres app (not Managed Postgres).

Setup:

• DB app: amouraos-postgis, plain Fly app running official postgis/postgis:17-3.5 image
• Main app: amouraos (Phoenix/Elixir), same org, region iad, IPv6 enabled

The error, when the main app connects via amouraos-postgis.internal:5432:

Postgrex.Error) FATAL 28P01 (invalid_password) password authentication failed for user "amouraos"

Proof the password is correct — connecting locally on the DB machine succeeds:

fly machine exec d8de560a2d1308 "psql postgresql://amouraos:postgres2026@localhost:5432/amouraos_prod -c 'SELECT current_user;'" --app amouraos-postgis
→ current_user: amouraos

DATABASE_URL used by the main app:

postgres://amouraos:postgres2026@amouraos-postgis.internal:5432/amouraos_prod

Same user, same password, same database — works on localhost, fails on .internal.

My guess: the default pg_hba.conf in this image only trusts 127.0.0.1/local socket connections, and rejects connections arriving over the Fly private IPv6 network — which Postgres reports as the misleading invalid_password error instead of a host-based rejection.

Question: What pg_hba.conf entry (or other config) is needed for this image to accept password auth over the Fly .internal network? Is there a documented pattern for running PostGIS as a plain Fly app rather than Fly Managed Postgres?