add postgresql role

ansible/roles/postgresql/README.md

@@ -0,0 +1,49 @@
+# Installation et configuration de Postgresql
+
+[TOC]
+
+## Documentation
+
+### Postgresql :
+* [Postgresql Official Documentation](https://www.postgresql.org/docs/) (EN)
+* [Postgresql Documentation Officielle](https://docs.postgresql.fr/) (FR)
+
+### Modules Ansible :
+* [Ansible Galaxy : Postgresql](https://galaxy.ansible.com/ui/repo/published/community/postgresql/) (EN)
+
+## Configuration
+
+### Variables
+* postgresql_monitoring_(user/password) : Identifiants liés à la supervision et à pmm.
+* postgresql_admin_role_attr_flags : Liste des rôles qu'on souhaite attribuer aux administrateurs. Défaut : CREATEDB,CREATEROLE,NOSUPERUSER.
+* postgresql_pmm_server : Adresse du serveur PMM.
+* postgresql_pmm_server_(username/password) : Identifiants utilisés pour se connecter au serveur PMM.
+* postgresql_pmm_client_(username/password) : Identifiants utilisés pour se connecter au serveur Postgresql local.
+* postgresql_users_networks : Liste des réseaux qui seront ajoutés au fichier pg_hba.conf pour les utilisateurs.
+* postgresql_databases : Liste des bases de données à créer.
+```
+postgresql_databases:
+    - name: "testsla"
+      (optional) owner: "testsla"
+      schemas:
+        - name: "testsla_schema"
+          owner: "testsla"
+
+### Tags
+* install : Installe Postgresql et ses dépendances.
+* config : Gère les configurations, créer les utilisateurs et effectue les tâches liées au monitoring.
+* backup : Installe les composants nécessaires aux sauvegardes.
+* monitoring : Installe et configure pmm-client.
+* databases : Créer les bases de données et leur schémas.
+
+## Fonctionnement du rôle
+
+### Basique pour comprendre Postgresql
+
+#### Rôles, utilisateurs et permissions
+* Un utilisateur correspond à un rôle avec un droit de login.
+* Tous les utilisateurs font partie du groupe "public".
+
+#### Base de données, schémas et tables.
+* Une base de données contient un ou plusieurs schémas qui contiennent une ou plusieurs tables.
+* Les bases de données contiennent par défaut un schema "public" sur lequel le groupe "public" a les droits de lecture.

ansible/roles/postgresql/defaults/main.yml

@@ -0,0 +1,21 @@
+---
+
+postgresql_default_data_dir: "/var/lib/postgresql/17/main"
+
+postgresql_pmm_client_username: "{{ lookup('hashi_vault', 'ansible/data/postgresql/pmm/{{ env }}/{{ postgresql_monitoring_user }}:pmm_client_username') }}"
+postgresql_pmm_client_password: "{{ lookup('hashi_vault', 'ansible/data/postgresql/pmm/{{ env }}/{{ postgresql_monitoring_user }}:pmm_client_password') }}"
+postgresql_pmm_server: "{{ lookup('hashi_vault', 'ansible/data/postgresql/pmm/server:pmm_server') }}"
+postgresql_pmm_server_username: "{{ lookup('hashi_vault', 'ansible/data/postgresql/pmm/server:pmm_server_username') }}"
+postgresql_pmm_server_password: "{{ lookup('hashi_vault', 'ansible/data/postgresql/pmm/server:pmm_server_password') }}"
+
+postgresql_monitoring_user: "monitoring"
+postgresql_monitoring_password: "{{ lookup('hashi_vault', 'ansible/data/postgresql/{{ env }}/monitoring:password') }}"
+
+postgresql_backup_user: "backup"
+postgresql_backup_password: "{{ lookup('hashi_vault', 'ansible/data/postgresql/{{ env }}/backup:password') }}"
+
+postgresql_replication_user: "replica"
+postgresql_replication_password: "{{ lookup('hashi_vault', 'ansible/data/postgresql/{{ env }}/replica:password') }}"
+
+postgresql_admin_role_attr_flags: "CREATEDB,CREATEROLE,NOSUPERUSER"
+postgresql_cmk_url: ""

ansible/roles/postgresql/files/postgresql.service

@@ -0,0 +1,17 @@
+[Unit]
+Description=PostgreSQL database server
+Documentation=man:postgres(1)
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=notify
+User=postgres
+ExecStart=/usr/lib/postgresql/16/bin/pg_ctl start -D /etc/postgresql/16/main/
+ExecReload=/bin/kill -HUP $MAINPID
+KillMode=mixed
+KillSignal=SIGINT
+TimeoutSec=infinity
+
+[Install]
+WantedBy=multi-user.target

ansible/roles/postgresql/handlers/main.yml

@@ -0,0 +1,10 @@
+---
+
+- name: Daemon_reload
+  ansible.builtin.systemd_service:
+    daemon_reload: true
+
+- name: Restart Postgres
+  ansible.builtin.systemd_service:
+    name: postgresql.service
+    state: restarted

ansible/roles/postgresql/tasks/backup.yml

@@ -0,0 +1,90 @@
+---
+
+- name: Install dependencies
+  ansible.builtin.apt:
+    name: "{{ item }}"
+    state: present
+  with_items:
+    - gnupg2
+    - lsb-release
+    - nfs-common
+  tags: install,config,backup
+
+- name: Setting up pg_hba conf for backup user
+  community.postgresql.postgresql_pg_hba:
+    dest: "{{ postgresql_default_data_dir }}/pg_hba.conf"
+    contype: host
+    users: backup
+    source: "127.0.0.1"
+    databases: all
+    method: scram-sha-256
+    create: true
+  become: true
+  become_user: postgres
+  tags: install,config,backup
+
+- name: Creating backup user
+  community.postgresql.postgresql_user:
+    name: "{{ postgresql_backup_user }}"
+    password: "{{ postgresql_backup_password }}"
+  become: true
+  become_user: postgres
+  tags: install,config,backup
+
+- name: Ensure needed directory exists
+  ansible.builtin.file:
+    path: "{{ item }}"
+    mode: "0755"
+    owner: root
+    group: root
+    state: directory
+  loop:
+    - "/data/scripts/"
+    - "/nas/"
+  tags: install,config,backup
+
+- name: Setting up mount point for nas
+  ansible.posix.mount:
+    path: "/nas"
+    src: "{{ postgresql_nfs_server }}:/data/shares/postgresql"
+    fstype: "nfs4"
+    opts: "rw,noatime,nodiratime,_netdev"
+    state: mounted
+  tags: install,config,backup
+
+- name: Deploying pgpass for backup user
+  ansible.builtin.template:
+    src: "pgpass-backup.j2"
+    dest: "/root/.pgpass"
+    owner: root
+    group: root
+    mode: "0600"
+  tags: install,config,backup
+
+- name: Deploying backup script
+  ansible.builtin.template:
+    src: "postgresql-dump-full.sh.j2"
+    dest: "/data/scripts/postgresql-dump-full.sh"
+    owner: root
+    group: root
+    mode: "0700"
+  tags: install,config,backup
+
+- name: Setting up cron for backup
+  ansible.builtin.cron:
+    name: "postgresql backup"
+    minute: "0"
+    hour: "14"
+    job: "/data/scripts/postgresql-dump-full.sh -r 10 -d /nas -c"
+    user: root
+    cron_file: postgresql-backup
+    state: present
+    disabled: true
+  tags: install,config,backup
+
+- name: Adding line to mrpe.cfg
+  ansible.builtin.lineinfile:
+    path: "/etc/check_mk/mrpe.cfg"
+    regexp: "^#postgresql_dump"
+    line: "#postgresql_dump /usr/local/nagios/plugins/check_batch postgresql-dump-full.sh 129600"
+  tags: install,config,backup

ansible/roles/postgresql/tasks/databases.yml

@@ -0,0 +1,33 @@
+---
+
+- name: Create databases
+  community.postgresql.postgresql_db:
+    name: "{{ item.name }}"
+    owner: "{{ item.owner | default('postgres') }}"
+  become: true
+  become_user: postgres
+  loop: "{{ postgresql_databases }}"
+  tags: databases
+
+- name: Create schemas in databases
+  community.postgresql.postgresql_schema:
+    name: "{{ item.1.name }}"
+    db: "{{ item.0.name }}"
+    owner: "{{ item.1.owner | default('postgres') }}"
+    comment: "{{ item.comment | default('') }}"
+  become: true
+  become_user: postgres
+  loop: "{{ postgresql_databases | subelements('schemas') }}"
+  tags: databases
+
+- name: Grant usage on new schemas to public role
+  community.postgresql.postgresql_privs:
+    database: "{{ item.0.name }}"
+    objs: "{{ item.1.name }}"
+    type: "schema"
+    privs: "USAGE"
+    role: "public"
+  become: true
+  become_user: postgres
+  loop: "{{ postgresql_databases | subelements('schemas') }}"
+  tags: databases

ansible/roles/postgresql/tasks/install.yml

@@ -0,0 +1,125 @@
+---
+
+- name: Install requirements
+  ansible.builtin.apt:
+    name: "{{ item }}"
+    state: present
+  with_items:
+    - gnupg
+    - curl
+    - apt-transport-https
+    - debian-keyring
+    - python3-psycopg2
+  tags: install,conf
+
+- name: Import postgres key
+  ansible.builtin.get_url:
+    url: "https://www.postgresql.org/media/keys/ACCC4CF8.asc"
+    dest: "/usr/share/keyrings/postgres.ACCC4CF8.asc"
+    mode: "0644"
+    force: true
+  tags: install
+
+- name: Add Postgres repository
+  ansible.builtin.apt_repository:
+    filename: postgres
+    repo: "deb [signed-by=/usr/share/keyrings/postgres.ACCC4CF8.asc] https://apt.postgresql.org/pub/repos/apt bookworm-pgdg main"
+  tags: install,conf
+
+- name: Install Postgresql
+  ansible.builtin.apt:
+    name: "{{ item }}"
+    state: present
+  tags: install,conf
+  with_items:
+    - postgresql
+    - postgresql-client
+    - libpq-dev
+
+- name: Holding postgres packages
+  ansible.builtin.dpkg_selections:
+    name: "{{ item }}"
+    selection: hold
+  with_items:
+    - postgresql
+    - postgresql-client
+    - libpq-dev
+    - python3-psycopg2
+  tags: install,conf
+
+- name: Deploy systemd service file
+  ansible.builtin.copy:
+    src: postgresql.service
+    dest: "/lib/systemd/system/postgresql.service"
+    mode: "0644"
+    owner: root
+    group: root
+  tags: install
+  notify:
+    - Daemon_reload
+    - Restart Postgres
+
+- name: Deploy Postgresql config file
+  ansible.builtin.copy:
+    src: "postgresql.conf"
+    dest: "/etc/postgresql/16/main/postgresql.conf"
+    owner: postgres
+    group: postgres
+    mode: "0644"
+  tags: install,conf
+  notify: Restart Postgres
+
+- name: Enable and start postgres service
+  ansible.builtin.systemd_service:
+    name: postgresql.service
+    state: started
+    enabled: true
+
+- name: Setting up pg_hba conf for postgres
+  community.postgresql.postgresql_pg_hba:
+    dest: "{{ postgresql_default_data_dir }}/pg_hba.conf"
+    contype: local
+    databases: all
+    users: postgres
+    method: peer
+    create: true
+  become: true
+  become_user: postgres
+  tags: install
+
+- name: Setting up pg_hba conf for replica
+  community.postgresql.postgresql_pg_hba:
+    dest: "{{ postgresql_default_data_dir }}/pg_hba.conf"
+    contype: host
+    databases: replication
+    source: "{{ item }}"
+    users: replica
+    method: scram-sha-256
+    create: true
+  become: true
+  become_user: postgres
+  with_items: "{{ postgresql_replication_networks }}"
+  tags: install
+
+- name: Creating replica users
+  community.postgresql.postgresql_user:
+    name: "{{ postgresql_replication_user }}"
+    password: "{{ postgresql_replication_password }}"
+    role_attr_flags: "REPLICATION"
+  become: true
+  become_user: postgres
+  tags: install
+
+- name: Setting up pg_hba conf for ILG/APP users
+  community.postgresql.postgresql_pg_hba:
+    dest: "{{ postgresql_default_data_dir }}/pg_hba.conf"
+    contype: host
+    users: all
+    source: "{{ item }}"
+    databases: all
+    method: scram-sha-256
+    create: true
+  with_items: "{{ postgresql_users_networks }}"
+  become: true
+  become_user: postgres
+  tags: install

ansible/roles/postgresql/tasks/main.yml

@@ -0,0 +1,17 @@
+---
+
+- name: Import install tasks
+  ansible.builtin.include_tasks: install.yml
+  tags: install
+
+- name: Import backup related tasks
+  ansible.builtin.include_tasks: backup.yml
+  tags: config,backup
+
+- name: Import monitoring tasks
+  ansible.builtin.include_tasks: monitoring.yml
+  tags: config,monitoring,pmm_register
+
+- name: Import database related tasks
+  ansible.builtin.include_tasks: databases.yml
+  tags: databases

ansible/roles/postgresql/tasks/monitoring.yml

@@ -0,0 +1,77 @@
+---
+
+- name: Setting up pg_hba conf for monitoring users
+  community.postgresql.postgresql_pg_hba:
+    dest: "{{ postgresql_default_data_dir }}/pg_hba.conf"
+    contype: host
+    source: 127.0.0.1
+    users: monitoring
+    databases: all
+    method: scram-sha-256
+    create: true
+  become: true
+  become_user: postgres
+  tags: config,monitoring
+
+- name: Creating monitoring user
+  community.postgresql.postgresql_user:
+    name: "{{ postgresql_monitoring_user }}"
+    password: "{{ postgresql_monitoring_password }}"
+  become: true
+  become_user: postgres
+  tags: config,monitoring
+
+- name: Granting privileges to monitoring user
+  community.postgresql.postgresql_privs:
+    database: postgres
+    type: group
+    roles: "{{ postgresql_monitoring_user }}"
+    objs: "pg_monitor"
+    state: present
+  become: true
+  become_user: postgres
+  tags: config,monitoring
+
+- name: Deploying checkmk config file
+  ansible.builtin.template:
+    src: "postgres.cfg.j2"
+    dest: "/etc/check_mk/postgres.cfg"
+    owner: root
+    group: root
+    mode: "0644"
+  tags: config,monitoring
+
+- name: Deploying checkmk mk_postgres.py
+  ansible.builtin.get_url:
+    url: "https://{{ postgres_cmk_url }}/check_mk/agents/plugins/mk_postgres.py"
+    dest: "/usr/lib/check_mk_agent/plugins/mk_postgres.py"
+    owner: root
+    group: root
+    mode: "0755"
+  tags: config,monitoring
+
+- name: Installing percona tools repo
+  ansible.builtin.apt:
+    deb: https://repo.percona.com/apt/percona-release_latest.{{ ansible_distribution_release }}_all.deb
+  tags: config,monitoring
+
+- name: Installation pmm2-client
+  ansible.builtin.apt:
+    update_cache: true
+    pkg: pmm2-client
+    state: present
+  tags: config,monitoring
+
+- name: Register on pmm server
+  ansible.builtin.command:
+    cmd: pmm-admin config --server-insecure-tls --server-url=https://{{ postgresql_pmm_server_username }}:{{ postgresql_pmm_server_password }}@{{ postgresql_pmm_server }}:443
+  register: register_server
+  changed_when: register_server.rc != 0
+  tags: pmm_register
+
+- name: Adding Postgresql to pmm
+  ansible.builtin.command:
+    cmd: pmm-admin add postgresql --username={{ postgresql_pmm_client_username }} --password={{ postgresql_pmm_client_password }}
+  register: add_server
+  changed_when: add_server.rc != 0
+  tags: pmm_register

ansible/roles/postgresql/templates/pgpass-backup.j2

@@ -0,0 +1 @@
+localhost:5432:*:{{ postgresql_backup_user }}:{{ postgresql_backup_password }}

ansible/roles/postgresql/templates/postgres.cfg.j2

@@ -0,0 +1 @@
+INSTANCE=127.0.0.1:{{ postgresql_monitoring_user }}:{{ postgresql_monitoring_password }}

ansible/roles/postgresql/templates/postgresql-dump-full.sh.j2

@@ -0,0 +1,92 @@
+#!/bin/bash
+
+set -eu
+
+DATE=$(date '+%Y%m%d %H%M%S')
+TODAY=$(date '+%Y%m%d')
+HOSTNAME=$(hostname -s)
+STATUS=0
+LOGFILE="/data/log/scripts/postgresql-dump-databases.log"
+PGSQL_HOST="localhost"
+PGSQL_USER="{{ postgresql_backup_user }}"
+COMPRESS=false
+
+touch ${LOGFILE}
+
+#
+# Fonctions
+#
+
+checkNas()
+{
+    if [ ! -e "${BACKUPDIR}/.mount" ]; then
+        echo "${BACKUPDIR} not mounted. Backup aborted." | tee -a ${LOGFILE}
+        exit 1
+    fi
+}
+
+usage()
+{
+  echo "$0 -r <retention> -d <repertoire> -c (compression)"
+  echo "Exemple : /data/scripts/postgresql-dump-full.sh -r 20 -d /nas -c"
+}
+
+#
+# Main
+#
+
+while getopts "hcr:d:" option
+do
+  case "${option}"
+  in
+    r)
+      RETENTION=${OPTARG};;
+    d)
+      BACKUPDIR=${OPTARG};;
+    c)
+      COMPRESS=true;;
+    h | *)
+      usage
+      exit 1;;
+  esac
+done
+
+echo "Lancement du dump - Retention : ${RETENTION} - Repertoire : ${BACKUPDIR}" | tee -a ${LOGFILE}
+
+mkdir -p "$BACKUPDIR"/postgresqldump/ | tee -a ${LOGFILE}
+find "$BACKUPDIR"/postgresqldump/ -mindepth 1 -maxdepth 1 -type f -daystart -mtime +"${RETENTION}" -delete | tee -a ${LOGFILE}
+
+# Ne marche pas quand le backup tourne sur un replica
+#echo "[${DATE}] - Granting superuser to ${PGSQL_USER} user" | tee -a ${LOGFILE}
+#/usr/bin/su - postgres -c "psql --command 'ALTER USER ${PGSQL_USER} WITH SUPERUSER'" | tee -a ${LOGFILE}
+
+DB_LIST=$(/usr/bin/su - postgres -c "psql --csv --command 'select datname from pg_catalog.pg_database'")
+for db in ${DB_LIST} ; do
+    if  [ ! "$db" = "datname" ] && [ ! "$db" = "template0" ] ; then
+        echo "[${DATE}] - Dumping database : $db" | tee -a ${LOGFILE}
+        if [ $COMPRESS = true ] ; then
+            /usr/bin/pg_dump -Z gzip -f "${BACKUPDIR}"/postgresqldump/"${TODAY}"-"${HOSTNAME}"-"${db}".gz -U "${PGSQL_USER}" -w -h "${PGSQL_HOST}" "${db}" | tee -a ${LOGFILE}
+            STATUS=${PIPESTATUS[0]}
+        else
+            /usr/bin/pg_dump -f "${BACKUPDIR}"/postgresqldump/"${TODAY}"-"${HOSTNAME}"-"${db}".sql -U "${PGSQL_USER}" -w -h "${PGSQL_HOST}" "${db}" | tee -a "${LOGFILE}"
+            STATUS=${PIPESTATUS[0]}
+        fi
+        if [ ! ${STATUS} -eq 0 ]; then
+            echo "[${DATE}][CRIT] Dump of $db failed" | tee -a ${LOGFILE}
+            echo "[${DATE}] - Revoking superuser from ${PGSQL_USER} user" | tee -a ${LOGFILE}
+            /usr/bin/su - postgres -c "psql --command 'ALTER USER ${PGSQL_USER} WITH NOSUPERUSER'" | tee -a ${LOGFILE}
+            OUTPUT="${OUTPUT} $db"
+            break
+        fi
+    fi
+done
+
+# Ne marche pas quand le backup tourne sur un replica
+#echo "[${DATE}] - Revoking superuser from ${PGSQL_USER} user" | tee -a ${LOGFILE}
+#/usr/bin/su - postgres -c "psql --command 'ALTER USER ${PGSQL_USER} WITH NOSUPERUSER'" | tee -a ${LOGFILE}
+
+STATUS=$?
+
+# output in statusfile for checkmk
+echo "$(date +%s)|${STATUS}|Check log file ${LOGFILE}" > /var/tmp/batch."$(basename "$0")"
+echo "Fin du dump - Retention : ${RETENTION} - Repertoire : ${BACKUPDIR}" | tee -a ${LOGFILE}

ansible/roles/postgresql/templates/postgresql.conf

@@ -0,0 +1,823 @@
+# -----------------------------
+# PostgreSQL configuration file
+# -----------------------------
+#
+# This file consists of lines of the form:
+#
+#   name = value
+#
+# (The "=" is optional.)  Whitespace may be used.  Comments are introduced with
+# "#" anywhere on a line.  The complete list of parameter names and allowed
+# values can be found in the PostgreSQL documentation.
+#
+# The commented-out settings shown in this file represent the default values.
+# Re-commenting a setting is NOT sufficient to revert it to the default value;
+# you need to reload the server.
+#
+# This file is read on server startup and when the server receives a SIGHUP
+# signal.  If you edit the file on a running system, you have to SIGHUP the
+# server for the changes to take effect, run "pg_ctl reload", or execute
+# "SELECT pg_reload_conf()".  Some parameters, which are marked below,
+# require a server shutdown and restart to take effect.
+#
+# Any parameter can also be given as a command-line option to the server, e.g.,
+# "postgres -c log_connections=on".  Some parameters can be changed at run time
+# with the "SET" SQL command.
+#
+# Memory units:  B  = bytes            Time units:  us  = microseconds
+#                kB = kilobytes                     ms  = milliseconds
+#                MB = megabytes                     s   = seconds
+#                GB = gigabytes                     min = minutes
+#                TB = terabytes                     h   = hours
+#                                                   d   = days
+
+
+#------------------------------------------------------------------------------
+# FILE LOCATIONS
+#------------------------------------------------------------------------------
+
+# The default values of these variables are driven from the -D command-line
+# option or PGDATA environment variable, represented here as ConfigDir.
+
+data_directory = '{{ postgresql_default_data_dir }}'		# use data in another directory
+					# (change requires restart)
+#hba_file = '/etc/postgresql/16/main/pg_hba.conf'	# host-based authentication file
+hba_file = '{{ postgresql_default_data_dir }}/pg_hba.conf'	# host-based authentication file
+					# (change requires restart)
+ident_file = '{{ postgresql_default_data_dir }}/pg_ident.conf'	# ident configuration file
+					# (change requires restart)
+
+# If external_pid_file is not explicitly set, no extra PID file is written.
+external_pid_file = '/var/run/postgresql/16-main.pid'			# write an extra PID file
+					# (change requires restart)
+
+
+#------------------------------------------------------------------------------
+# CONNECTIONS AND AUTHENTICATION
+#------------------------------------------------------------------------------
+
+# - Connection Settings -
+
+listen_addresses = '*'		        # what IP address(es) to listen on;
+					# comma-separated list of addresses;
+					# defaults to 'localhost'; use '*' for all
+					# (change requires restart)
+port = 5432				# (change requires restart)
+max_connections = {{ postgresql_max_connections | default("100") }}			# (change requires restart)
+#reserved_connections = 0		# (change requires restart)
+#superuser_reserved_connections = 3	# (change requires restart)
+unix_socket_directories = '/var/run/postgresql' # comma-separated list of directories
+					# (change requires restart)
+#unix_socket_group = ''			# (change requires restart)
+#unix_socket_permissions = 0777		# begin with 0 to use octal notation
+					# (change requires restart)
+#bonjour = off				# advertise server via Bonjour
+					# (change requires restart)
+#bonjour_name = ''			# defaults to the computer name
+					# (change requires restart)
+
+# - TCP settings -
+# see "man tcp" for details
+
+#tcp_keepalives_idle = 0		# TCP_KEEPIDLE, in seconds;
+					# 0 selects the system default
+#tcp_keepalives_interval = 0		# TCP_KEEPINTVL, in seconds;
+					# 0 selects the system default
+#tcp_keepalives_count = 0		# TCP_KEEPCNT;
+					# 0 selects the system default
+#tcp_user_timeout = 0			# TCP_USER_TIMEOUT, in milliseconds;
+					# 0 selects the system default
+
+#client_connection_check_interval = 0	# time between checks for client
+					# disconnection while running queries;
+					# 0 for never
+
+# - Authentication -
+
+#authentication_timeout = 1min		# 1s-600s
+#password_encryption = scram-sha-256	# scram-sha-256 or md5
+#scram_iterations = 4096
+#db_user_namespace = off
+
+# GSSAPI using Kerberos
+#krb_server_keyfile = 'FILE:${sysconfdir}/krb5.keytab'
+#krb_caseins_users = off
+#gss_accept_delegation = off
+
+# - SSL -
+
+ssl = on
+#ssl_ca_file = ''
+ssl_cert_file = '/etc/ssl/certs/ssl-cert-snakeoil.pem'
+#ssl_crl_file = ''
+#ssl_crl_dir = ''
+ssl_key_file = '/etc/ssl/private/ssl-cert-snakeoil.key'
+#ssl_ciphers = 'HIGH:MEDIUM:+3DES:!aNULL' # allowed SSL ciphers
+#ssl_prefer_server_ciphers = on
+#ssl_ecdh_curve = 'prime256v1'
+#ssl_min_protocol_version = 'TLSv1.2'
+#ssl_max_protocol_version = ''
+#ssl_dh_params_file = ''
+#ssl_passphrase_command = ''
+#ssl_passphrase_command_supports_reload = off
+
+
+#------------------------------------------------------------------------------
+# RESOURCE USAGE (except WAL)
+#------------------------------------------------------------------------------
+
+# - Memory -
+
+shared_buffers = 128MB			# min 128kB
+					# (change requires restart)
+#huge_pages = try			# on, off, or try
+					# (change requires restart)
+#huge_page_size = 0			# zero for system default
+					# (change requires restart)
+#temp_buffers = 8MB			# min 800kB
+#max_prepared_transactions = 0		# zero disables the feature
+					# (change requires restart)
+# Caution: it is not advisable to set max_prepared_transactions nonzero unless
+# you actively intend to use prepared transactions.
+#work_mem = 4MB				# min 64kB
+#hash_mem_multiplier = 2.0		# 1-1000.0 multiplier on hash table work_mem
+#maintenance_work_mem = 64MB		# min 1MB
+#autovacuum_work_mem = -1		# min 1MB, or -1 to use maintenance_work_mem
+#logical_decoding_work_mem = 64MB	# min 64kB
+#max_stack_depth = 2MB			# min 100kB
+#shared_memory_type = mmap		# the default is the first option
+					# supported by the operating system:
+					#   mmap
+					#   sysv
+					#   windows
+					# (change requires restart)
+dynamic_shared_memory_type = posix	# the default is usually the first option
+					# supported by the operating system:
+					#   posix
+					#   sysv
+					#   windows
+					#   mmap
+					# (change requires restart)
+#min_dynamic_shared_memory = 0MB	# (change requires restart)
+#vacuum_buffer_usage_limit = 256kB	# size of vacuum and analyze buffer access strategy ring;
+					# 0 to disable vacuum buffer access strategy;
+					# range 128kB to 16GB
+
+# - Disk -
+
+#temp_file_limit = -1			# limits per-process temp file space
+					# in kilobytes, or -1 for no limit
+
+# - Kernel Resources -
+
+#max_files_per_process = 1000		# min 64
+					# (change requires restart)
+
+# - Cost-Based Vacuum Delay -
+
+#vacuum_cost_delay = 0			# 0-100 milliseconds (0 disables)
+#vacuum_cost_page_hit = 1		# 0-10000 credits
+#vacuum_cost_page_miss = 2		# 0-10000 credits
+#vacuum_cost_page_dirty = 20		# 0-10000 credits
+#vacuum_cost_limit = 200		# 1-10000 credits
+
+# - Background Writer -
+
+#bgwriter_delay = 200ms			# 10-10000ms between rounds
+#bgwriter_lru_maxpages = 100		# max buffers written/round, 0 disables
+#bgwriter_lru_multiplier = 2.0		# 0-10.0 multiplier on buffers scanned/round
+#bgwriter_flush_after = 512kB		# measured in pages, 0 disables
+
+# - Asynchronous Behavior -
+
+#backend_flush_after = 0		# measured in pages, 0 disables
+#effective_io_concurrency = 1		# 1-1000; 0 disables prefetching
+#maintenance_io_concurrency = 10	# 1-1000; 0 disables prefetching
+#max_worker_processes = 8		# (change requires restart)
+#max_parallel_workers_per_gather = 2	# taken from max_parallel_workers
+#max_parallel_maintenance_workers = 2	# taken from max_parallel_workers
+#max_parallel_workers = 8		# maximum number of max_worker_processes that
+					# can be used in parallel operations
+#parallel_leader_participation = on
+#old_snapshot_threshold = -1		# 1min-60d; -1 disables; 0 is immediate
+					# (change requires restart)
+
+
+#------------------------------------------------------------------------------
+# WRITE-AHEAD LOG
+#------------------------------------------------------------------------------
+
+# - Settings -
+
+#wal_level = replica			# minimal, replica, or logical
+					# (change requires restart)
+#fsync = on				# flush data to disk for crash safety
+					# (turning this off can cause
+					# unrecoverable data corruption)
+#synchronous_commit = on		# synchronization level;
+					# off, local, remote_write, remote_apply, or on
+#wal_sync_method = fsync		# the default is the first option
+					# supported by the operating system:
+					#   open_datasync
+					#   fdatasync (default on Linux and FreeBSD)
+					#   fsync
+					#   fsync_writethrough
+					#   open_sync
+#full_page_writes = on			# recover from partial page writes
+#wal_log_hints = off			# also do full page writes of non-critical updates
+					# (change requires restart)
+#wal_compression = off			# enables compression of full-page writes;
+					# off, pglz, lz4, zstd, or on
+#wal_init_zero = on			# zero-fill new WAL files
+#wal_recycle = on			# recycle WAL files
+#wal_buffers = -1			# min 32kB, -1 sets based on shared_buffers
+					# (change requires restart)
+#wal_writer_delay = 200ms		# 1-10000 milliseconds
+#wal_writer_flush_after = 1MB		# measured in pages, 0 disables
+#wal_skip_threshold = 2MB
+
+#commit_delay = 0			# range 0-100000, in microseconds
+#commit_siblings = 5			# range 1-1000
+
+# - Checkpoints -
+
+#checkpoint_timeout = 5min		# range 30s-1d
+#checkpoint_completion_target = 0.9	# checkpoint target duration, 0.0 - 1.0
+#checkpoint_flush_after = 256kB		# measured in pages, 0 disables
+#checkpoint_warning = 30s		# 0 disables
+max_wal_size = 1GB
+min_wal_size = 80MB
+
+# - Prefetching during recovery -
+
+#recovery_prefetch = try		# prefetch pages referenced in the WAL?
+#wal_decode_buffer_size = 512kB		# lookahead window used for prefetching
+					# (change requires restart)
+
+# - Archiving -
+
+#archive_mode = off		# enables archiving; off, on, or always
+				# (change requires restart)
+#archive_library = ''		# library to use to archive a WAL file
+				# (empty string indicates archive_command should
+				# be used)
+#archive_command = ''		# command to use to archive a WAL file
+				# placeholders: %p = path of file to archive
+				#               %f = file name only
+				# e.g. 'test ! -f /mnt/server/archivedir/%f && cp %p /mnt/server/archivedir/%f'
+#archive_timeout = 0		# force a WAL file switch after this
+				# number of seconds; 0 disables
+
+# - Archive Recovery -
+
+# These are only used in recovery mode.
+
+#restore_command = ''		# command to use to restore an archived WAL file
+				# placeholders: %p = path of file to restore
+				#               %f = file name only
+				# e.g. 'cp /mnt/server/archivedir/%f %p'
+#archive_cleanup_command = ''	# command to execute at every restartpoint
+#recovery_end_command = ''	# command to execute at completion of recovery
+
+# - Recovery Target -
+
+# Set these only when performing a targeted recovery.
+
+#recovery_target = ''		# 'immediate' to end recovery as soon as a
+                                # consistent state is reached
+				# (change requires restart)
+#recovery_target_name = ''	# the named restore point to which recovery will proceed
+				# (change requires restart)
+#recovery_target_time = ''	# the time stamp up to which recovery will proceed
+				# (change requires restart)
+#recovery_target_xid = ''	# the transaction ID up to which recovery will proceed
+				# (change requires restart)
+#recovery_target_lsn = ''	# the WAL LSN up to which recovery will proceed
+				# (change requires restart)
+#recovery_target_inclusive = on # Specifies whether to stop:
+				# just after the specified recovery target (on)
+				# just before the recovery target (off)
+				# (change requires restart)
+#recovery_target_timeline = 'latest'	# 'current', 'latest', or timeline ID
+				# (change requires restart)
+#recovery_target_action = 'pause'	# 'pause', 'promote', 'shutdown'
+				# (change requires restart)
+
+
+#------------------------------------------------------------------------------
+# REPLICATION
+#------------------------------------------------------------------------------
+
+# - Sending Servers -
+
+# Set these on the primary and on any standby that will send replication data.
+
+#max_wal_senders = 10		# max number of walsender processes
+				# (change requires restart)
+#max_replication_slots = 10	# max number of replication slots
+				# (change requires restart)
+#wal_keep_size = 0		# in megabytes; 0 disables
+#max_slot_wal_keep_size = -1	# in megabytes; -1 disables
+#wal_sender_timeout = 60s	# in milliseconds; 0 disables
+#track_commit_timestamp = off	# collect timestamp of transaction commit
+				# (change requires restart)
+
+# - Primary Server -
+
+# These settings are ignored on a standby server.
+
+#synchronous_standby_names = ''	# standby servers that provide sync rep
+				# method to choose sync standbys, number of sync standbys,
+				# and comma-separated list of application_name
+				# from standby(s); '*' = all
+
+# - Standby Servers -
+
+# These settings are ignored on a primary server.
+
+#primary_conninfo = ''			# connection string to sending server
+#primary_slot_name = ''			# replication slot on sending server
+#hot_standby = on			# "off" disallows queries during recovery
+					# (change requires restart)
+#max_standby_archive_delay = 30s	# max delay before canceling queries
+					# when reading WAL from archive;
+					# -1 allows indefinite delay
+#max_standby_streaming_delay = 30s	# max delay before canceling queries
+					# when reading streaming WAL;
+					# -1 allows indefinite delay
+#wal_receiver_create_temp_slot = off	# create temp slot if primary_slot_name
+					# is not set
+#wal_receiver_status_interval = 10s	# send replies at least this often
+					# 0 disables
+#hot_standby_feedback = off		# send info from standby to prevent
+					# query conflicts
+#wal_receiver_timeout = 60s		# time that receiver waits for
+					# communication from primary
+					# in milliseconds; 0 disables
+#wal_retrieve_retry_interval = 5s	# time to wait before retrying to
+					# retrieve WAL after a failed attempt
+#recovery_min_apply_delay = 0		# minimum delay for applying changes during recovery
+
+# - Subscribers -
+
+# These settings are ignored on a publisher.
+
+#max_logical_replication_workers = 4	# taken from max_worker_processes
+					# (change requires restart)
+#max_sync_workers_per_subscription = 2	# taken from max_logical_replication_workers
+#max_parallel_apply_workers_per_subscription = 2	# taken from max_logical_replication_workers
+
+
+#------------------------------------------------------------------------------
+# QUERY TUNING
+#------------------------------------------------------------------------------
+
+# - Planner Method Configuration -
+
+#enable_async_append = on
+#enable_bitmapscan = on
+#enable_gathermerge = on
+#enable_hashagg = on
+#enable_hashjoin = on
+#enable_incremental_sort = on
+#enable_indexscan = on
+#enable_indexonlyscan = on
+#enable_material = on
+#enable_memoize = on
+#enable_mergejoin = on
+#enable_nestloop = on
+#enable_parallel_append = on
+#enable_parallel_hash = on
+#enable_partition_pruning = on
+#enable_partitionwise_join = off
+#enable_partitionwise_aggregate = off
+#enable_presorted_aggregate = on
+#enable_seqscan = on
+#enable_sort = on
+#enable_tidscan = on
+
+# - Planner Cost Constants -
+
+#seq_page_cost = 1.0			# measured on an arbitrary scale
+#random_page_cost = 4.0			# same scale as above
+#cpu_tuple_cost = 0.01			# same scale as above
+#cpu_index_tuple_cost = 0.005		# same scale as above
+#cpu_operator_cost = 0.0025		# same scale as above
+#parallel_setup_cost = 1000.0	# same scale as above
+#parallel_tuple_cost = 0.1		# same scale as above
+#min_parallel_table_scan_size = 8MB
+#min_parallel_index_scan_size = 512kB
+#effective_cache_size = 4GB
+
+#jit_above_cost = 100000		# perform JIT compilation if available
+					# and query more expensive than this;
+					# -1 disables
+#jit_inline_above_cost = 500000		# inline small functions if query is
+					# more expensive than this; -1 disables
+#jit_optimize_above_cost = 500000	# use expensive JIT optimizations if
+					# query is more expensive than this;
+					# -1 disables
+
+# - Genetic Query Optimizer -
+
+#geqo = on
+#geqo_threshold = 12
+#geqo_effort = 5			# range 1-10
+#geqo_pool_size = 0			# selects default based on effort
+#geqo_generations = 0			# selects default based on effort
+#geqo_selection_bias = 2.0		# range 1.5-2.0
+#geqo_seed = 0.0			# range 0.0-1.0
+
+# - Other Planner Options -
+
+#default_statistics_target = 100	# range 1-10000
+#constraint_exclusion = partition	# on, off, or partition
+#cursor_tuple_fraction = 0.1		# range 0.0-1.0
+#from_collapse_limit = 8
+#jit = on				# allow JIT compilation
+#join_collapse_limit = 8		# 1 disables collapsing of explicit
+					# JOIN clauses
+#plan_cache_mode = auto			# auto, force_generic_plan or
+					# force_custom_plan
+#recursive_worktable_factor = 10.0	# range 0.001-1000000
+
+
+#------------------------------------------------------------------------------
+# REPORTING AND LOGGING
+#------------------------------------------------------------------------------
+
+# - Where to Log -
+
+#log_destination = 'stderr'		# Valid values are combinations of
+					# stderr, csvlog, jsonlog, syslog, and
+					# eventlog, depending on platform.
+					# csvlog and jsonlog require
+					# logging_collector to be on.
+
+# This is used when logging to stderr:
+#logging_collector = off		# Enable capturing of stderr, jsonlog,
+					# and csvlog into log files. Required
+					# to be on for csvlogs and jsonlogs.
+					# (change requires restart)
+
+# These are only used if logging_collector is on:
+#log_directory = 'log'			# directory where log files are written,
+					# can be absolute or relative to PGDATA
+#log_filename = 'postgresql-%Y-%m-%d_%H%M%S.log'	# log file name pattern,
+					# can include strftime() escapes
+#log_file_mode = 0600			# creation mode for log files,
+					# begin with 0 to use octal notation
+#log_rotation_age = 1d			# Automatic rotation of logfiles will
+					# happen after that time.  0 disables.
+#log_rotation_size = 10MB		# Automatic rotation of logfiles will
+					# happen after that much log output.
+					# 0 disables.
+#log_truncate_on_rotation = off		# If on, an existing log file with the
+					# same name as the new log file will be
+					# truncated rather than appended to.
+					# But such truncation only occurs on
+					# time-driven rotation, not on restarts
+					# or size-driven rotation.  Default is
+					# off, meaning append to existing files
+					# in all cases.
+
+# These are relevant when logging to syslog:
+#syslog_facility = 'LOCAL0'
+#syslog_ident = 'postgres'
+#syslog_sequence_numbers = on
+#syslog_split_messages = on
+
+# This is only relevant when logging to eventlog (Windows):
+# (change requires restart)
+#event_source = 'PostgreSQL'
+
+# - When to Log -
+
+#log_min_messages = warning		# values in order of decreasing detail:
+					#   debug5
+					#   debug4
+					#   debug3
+					#   debug2
+					#   debug1
+					#   info
+					#   notice
+					#   warning
+					#   error
+					#   log
+					#   fatal
+					#   panic
+
+#log_min_error_statement = error	# values in order of decreasing detail:
+					#   debug5
+					#   debug4
+					#   debug3
+					#   debug2
+					#   debug1
+					#   info
+					#   notice
+					#   warning
+					#   error
+					#   log
+					#   fatal
+					#   panic (effectively off)
+
+#log_min_duration_statement = -1	# -1 is disabled, 0 logs all statements
+					# and their durations, > 0 logs only
+					# statements running at least this number
+					# of milliseconds
+
+#log_min_duration_sample = -1		# -1 is disabled, 0 logs a sample of statements
+					# and their durations, > 0 logs only a sample of
+					# statements running at least this number
+					# of milliseconds;
+					# sample fraction is determined by log_statement_sample_rate
+
+#log_statement_sample_rate = 1.0	# fraction of logged statements exceeding
+					# log_min_duration_sample to be logged;
+					# 1.0 logs all such statements, 0.0 never logs
+
+
+#log_transaction_sample_rate = 0.0	# fraction of transactions whose statements
+					# are logged regardless of their duration; 1.0 logs all
+					# statements from all transactions, 0.0 never logs
+
+#log_startup_progress_interval = 10s	# Time between progress updates for
+					# long-running startup operations.
+					# 0 disables the feature, > 0 indicates
+					# the interval in milliseconds.
+
+# - What to Log -
+
+#debug_print_parse = off
+#debug_print_rewritten = off
+#debug_print_plan = off
+#debug_pretty_print = on
+#log_autovacuum_min_duration = 10min	# log autovacuum activity;
+					# -1 disables, 0 logs all actions and
+					# their durations, > 0 logs only
+					# actions running at least this number
+					# of milliseconds.
+#log_checkpoints = on
+#log_connections = off
+#log_disconnections = off
+#log_duration = off
+#log_error_verbosity = default		# terse, default, or verbose messages
+#log_hostname = off
+log_line_prefix = '%m [%p] %q%u@%d '		# special values:
+					#   %a = application name
+					#   %u = user name
+					#   %d = database name
+					#   %r = remote host and port
+					#   %h = remote host
+					#   %b = backend type
+					#   %p = process ID
+					#   %P = process ID of parallel group leader
+					#   %t = timestamp without milliseconds
+					#   %m = timestamp with milliseconds
+					#   %n = timestamp with milliseconds (as a Unix epoch)
+					#   %Q = query ID (0 if none or not computed)
+					#   %i = command tag
+					#   %e = SQL state
+					#   %c = session ID
+					#   %l = session line number
+					#   %s = session start timestamp
+					#   %v = virtual transaction ID
+					#   %x = transaction ID (0 if none)
+					#   %q = stop here in non-session
+					#        processes
+					#   %% = '%'
+					# e.g. '<%u%%%d> '
+#log_lock_waits = off			# log lock waits >= deadlock_timeout
+#log_recovery_conflict_waits = off	# log standby recovery conflict waits
+					# >= deadlock_timeout
+#log_parameter_max_length = -1		# when logging statements, limit logged
+					# bind-parameter values to N bytes;
+					# -1 means print in full, 0 disables
+#log_parameter_max_length_on_error = 0	# when logging an error, limit logged
+					# bind-parameter values to N bytes;
+					# -1 means print in full, 0 disables
+#log_statement = 'none'			# none, ddl, mod, all
+#log_replication_commands = off
+#log_temp_files = -1			# log temporary files equal or larger
+					# than the specified size in kilobytes;
+					# -1 disables, 0 logs all temp files
+log_timezone = 'Europe/Paris'
+
+# - Process Title -
+
+cluster_name = '16/main'			# added to process titles if nonempty
+					# (change requires restart)
+#update_process_title = on
+
+
+#------------------------------------------------------------------------------
+# STATISTICS
+#------------------------------------------------------------------------------
+
+# - Cumulative Query and Index Statistics -
+
+#track_activities = on
+#track_activity_query_size = 1024	# (change requires restart)
+#track_counts = on
+#track_io_timing = off
+#track_wal_io_timing = off
+#track_functions = none			# none, pl, all
+#stats_fetch_consistency = cache	# cache, none, snapshot
+
+
+# - Monitoring -
+
+#compute_query_id = auto
+#log_statement_stats = off
+#log_parser_stats = off
+#log_planner_stats = off
+#log_executor_stats = off
+
+
+#------------------------------------------------------------------------------
+# AUTOVACUUM
+#------------------------------------------------------------------------------
+
+#autovacuum = on			# Enable autovacuum subprocess?  'on'
+					# requires track_counts to also be on.
+#autovacuum_max_workers = 3		# max number of autovacuum subprocesses
+					# (change requires restart)
+#autovacuum_naptime = 1min		# time between autovacuum runs
+#autovacuum_vacuum_threshold = 50	# min number of row updates before
+					# vacuum
+#autovacuum_vacuum_insert_threshold = 1000	# min number of row inserts
+					# before vacuum; -1 disables insert
+					# vacuums
+#autovacuum_analyze_threshold = 50	# min number of row updates before
+					# analyze
+#autovacuum_vacuum_scale_factor = 0.2	# fraction of table size before vacuum
+#autovacuum_vacuum_insert_scale_factor = 0.2	# fraction of inserts over table
+					# size before insert vacuum
+#autovacuum_analyze_scale_factor = 0.1	# fraction of table size before analyze
+#autovacuum_freeze_max_age = 200000000	# maximum XID age before forced vacuum
+					# (change requires restart)
+#autovacuum_multixact_freeze_max_age = 400000000	# maximum multixact age
+					# before forced vacuum
+					# (change requires restart)
+#autovacuum_vacuum_cost_delay = 2ms	# default vacuum cost delay for
+					# autovacuum, in milliseconds;
+					# -1 means use vacuum_cost_delay
+#autovacuum_vacuum_cost_limit = -1	# default vacuum cost limit for
+					# autovacuum, -1 means use
+					# vacuum_cost_limit
+
+
+#------------------------------------------------------------------------------
+# CLIENT CONNECTION DEFAULTS
+#------------------------------------------------------------------------------
+
+# - Statement Behavior -
+
+#client_min_messages = notice		# values in order of decreasing detail:
+					#   debug5
+					#   debug4
+					#   debug3
+					#   debug2
+					#   debug1
+					#   log
+					#   notice
+					#   warning
+					#   error
+#search_path = '"$user", public'	# schema names
+#row_security = on
+#default_table_access_method = 'heap'
+#default_tablespace = ''		# a tablespace name, '' uses the default
+#default_toast_compression = 'pglz'	# 'pglz' or 'lz4'
+#temp_tablespaces = ''			# a list of tablespace names, '' uses
+					# only default tablespace
+#check_function_bodies = on
+#default_transaction_isolation = 'read committed'
+#default_transaction_read_only = off
+#default_transaction_deferrable = off
+#session_replication_role = 'origin'
+#statement_timeout = 0			# in milliseconds, 0 is disabled
+#lock_timeout = 0			# in milliseconds, 0 is disabled
+#idle_in_transaction_session_timeout = 0	# in milliseconds, 0 is disabled
+#idle_session_timeout = 0		# in milliseconds, 0 is disabled
+#vacuum_freeze_table_age = 150000000
+#vacuum_freeze_min_age = 50000000
+#vacuum_failsafe_age = 1600000000
+#vacuum_multixact_freeze_table_age = 150000000
+#vacuum_multixact_freeze_min_age = 5000000
+#vacuum_multixact_failsafe_age = 1600000000
+#bytea_output = 'hex'			# hex, escape
+#xmlbinary = 'base64'
+#xmloption = 'content'
+#gin_pending_list_limit = 4MB
+#createrole_self_grant = ''		# set and/or inherit
+
+# - Locale and Formatting -
+
+datestyle = 'iso, mdy'
+#intervalstyle = 'postgres'
+timezone = 'Europe/Paris'
+#timezone_abbreviations = 'Default'     # Select the set of available time zone
+					# abbreviations.  Currently, there are
+					#   Default
+					#   Australia (historical usage)
+					#   India
+					# You can create your own file in
+					# share/timezonesets/.
+#extra_float_digits = 1			# min -15, max 3; any value >0 actually
+					# selects precise output mode
+#client_encoding = sql_ascii		# actually, defaults to database
+					# encoding
+
+# These settings are initialized by initdb, but they can be changed.
+lc_messages = 'en_US.UTF-8'		# locale for system error message
+					# strings
+lc_monetary = 'en_US.UTF-8'		# locale for monetary formatting
+lc_numeric = 'en_US.UTF-8'		# locale for number formatting
+lc_time = 'en_US.UTF-8'			# locale for time formatting
+
+#icu_validation_level = warning		# report ICU locale validation
+					# errors at the given level
+
+# default configuration for text search
+default_text_search_config = 'pg_catalog.english'
+
+# - Shared Library Preloading -
+
+#local_preload_libraries = ''
+#session_preload_libraries = ''
+#shared_preload_libraries = ''	# (change requires restart)
+#jit_provider = 'llvmjit'		# JIT library to use
+
+# - Other Defaults -
+
+#dynamic_library_path = '$libdir'
+#extension_destdir = ''			# prepend path when loading extensions
+					# and shared objects (added by Debian)
+#gin_fuzzy_search_limit = 0
+
+
+#------------------------------------------------------------------------------
+# LOCK MANAGEMENT
+#------------------------------------------------------------------------------
+
+#deadlock_timeout = 1s
+#max_locks_per_transaction = 64		# min 10
+					# (change requires restart)
+#max_pred_locks_per_transaction = 64	# min 10
+					# (change requires restart)
+#max_pred_locks_per_relation = -2	# negative values mean
+					# (max_pred_locks_per_transaction
+					#  / -max_pred_locks_per_relation) - 1
+#max_pred_locks_per_page = 2            # min 0
+
+
+#------------------------------------------------------------------------------
+# VERSION AND PLATFORM COMPATIBILITY
+#------------------------------------------------------------------------------
+
+# - Previous PostgreSQL Versions -
+
+#array_nulls = on
+#backslash_quote = safe_encoding	# on, off, or safe_encoding
+#escape_string_warning = on
+#lo_compat_privileges = off
+#quote_all_identifiers = off
+#standard_conforming_strings = on
+#synchronize_seqscans = on
+
+# - Other Platforms and Clients -
+
+#transform_null_equals = off
+
+
+#------------------------------------------------------------------------------
+# ERROR HANDLING
+#------------------------------------------------------------------------------
+
+#exit_on_error = off			# terminate session on any error?
+#restart_after_crash = on		# reinitialize after backend crash?
+#data_sync_retry = off			# retry or panic on failure to fsync
+					# data?
+					# (change requires restart)
+#recovery_init_sync_method = fsync	# fsync, syncfs (Linux 5.8+)
+
+
+#------------------------------------------------------------------------------
+# CONFIG FILE INCLUDES
+#------------------------------------------------------------------------------
+
+# These options allow settings to be loaded from files other than the
+# default postgresql.conf.  Note that these are directives, not variable
+# assignments, so they can usefully be given more than once.
+
+include_dir = 'conf.d'			# include files ending in '.conf' from
+					# a directory, e.g., 'conf.d'
+#include_if_exists = '...'		# include file only if it exists
+#include = '...'			# include file
+
+
+#------------------------------------------------------------------------------
+# CUSTOMIZED OPTIONS
+#------------------------------------------------------------------------------
+
+# Add settings for extensions here