A fresh PostgreSQL install on Ubuntu or Debian listens only on localhost. Trouble usually starts later, when the port is opened for an app server and nobody goes back to check pg_hba.conf or which role the app logs in as. This guide walks through network exposure, client authentication, TLS, roles, logging, and backups on a production server, with a check for each change.

The examples use PostgreSQL 16 from apt, with configuration in /etc/postgresql/16/main/ . Ubuntu 24.04 ships 16. Debian 12's own repository ships 15, so adjust the paths or install 16 from apt.postgresql.org. Check what you have:

pg_lsclusters

Enter fullscreen mode

Exit fullscreen mode

Ver Cluster Port Status Owner Data directory Log file 16 main 5432 online postgres /var/lib/postgresql/16/main /var/log/postgresql/postgresql-16-main.log

Enter fullscreen mode

Exit fullscreen mode

Control where PostgreSQL listens

listen_addresses sets which interfaces the server binds to.…