PgBouncer With SCRAM, Proven Against PostgreSQL 16
PgBouncer from EPEL on loopback with SCRAM authentication, where the package defaults to md5. It has no config checker but refuses an unknown setting at start. Against a real PostgreSQL 16, a SCRAM query goes through, a wrong password is refused, five sessions share one server session, and the admin console refuses an ordinary user. Original role, live-tested on Rocky Linux 10.
Verification
Live-testedReally deployed to a container sandbox, proven idempotent (a second run changes nothing), verified against the role’s assertions, then torn down.
Conformance
- Static validation (yamllint · ansible-lint)
Provenance
- SHA-256 checksum
- Signature (pending)
Functional
- Live-tested - applied, verified, destroyed
Last verified 2026-10-02 · podman 4.9.3 · ansible 2.21.4 · how we verify
Cite it in your README
badge · attributionPaste this beside the module in the repository that uses it. The badge is rendered from this artifact's verification record, so it reads live-tested because the record says so, and the link lands on this page.
[](https://www.iac-bazaar.com/catalog/ansible-pgbouncer?utm_source=syndication&utm_medium=readme&utm_campaign=artifact)
Ansible role 1.0.0, live-tested on IaC Bazaar: [PgBouncer With SCRAM, Proven Against PostgreSQL 16](https://www.iac-bazaar.com/catalog/ansible-pgbouncer?utm_source=syndication&utm_medium=readme&utm_campaign=artifact)
```yaml
# PgBouncer With SCRAM, Proven Against PostgreSQL 16: https://www.iac-bazaar.com/catalog/ansible-pgbouncer (download from your IaC Bazaar account)
```Preview:
Documentation
pgbouncer
PgBouncer from EPEL: a connection pooler in front of PostgreSQL, on loopback, with SCRAM authentication, a fallback route for every database name, and the admin console limited to the users you name. Original role for EL 10, live-tested with podman on Rocky Linux 10 against PostgreSQL 16.
No download, and no version to pin. EL 10 packages pgbouncer in EPEL, so the
role installs it by name and takes what the distribution ships: a security
update arrives through dnf, not through a new release of this role. What the
role owns is the configuration and the proof that the service works.
The distribution's unit, our configuration. The role installs
pgbouncer, writes the configuration the package leaves open, and
enables the unit the package ships: systemctl cat pgbouncer shows the
distribution's own unit, not one this role invented. The listener is
127.0.0.1:6432 by default, for a proxy that authenticates or a
client on the same host; the live test reads the listening sockets and
expects loopback only.
The package defaults to md5. EPEL's pgbouncer.ini sets
auth_type = md5 (measured), while PostgreSQL 16 stores SCRAM verifiers. The
role sets scram-sha-256, and the live test reads it back from SHOW CONFIG.
An auth file entry can be the SCRAM verifier copied from pg_authid - no
password on disk - which is what the test uses.
No checker, and no half-start. pgbouncer has no configuration checker
(nothing in --help), but an unknown or an invalid setting stops it at start
(both measured), so a bad file fails the play at the restart. The unit is
Type=notify-reload, so systemd itself waits for pgbouncer to say it is ready.
Proven by pooling. Against a real PostgreSQL 16, the live test queries through the pooler with SCRAM, sees a wrong password refused, runs five client sessions one after another and finds ONE server session behind them, and sees the admin console answer an admin and refuse an ordinary user.
License
Commercial - IaC Bazaar EULA. (c) IaC Bazaar.
Usage code & full reference need an account
The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.
- Variables
- Test
Related modules
ansible-clickhouse
ClickHouse on EL 10 from the upstream LTS release (sha512-verified), as a hardened systemd service on loopback with the default user behind a password; the live test creates a MergeTree table, inserts a row and selects it back over HTTP; a query without credentials is refused. Original role, live-tested on Rocky Linux 10.
ansible-dragonfly
Dragonfly on EL 10 from the vendor's release, pinned by a SHA-256 the role carries (the vendor publishes no checksum file), as a hardened systemd service on loopback behind a password kept in a flagfile; the live test speaks RESP itself: an unauthenticated PING and a wrong password are refused, AUTH + SET + GET round-trip. Original role, live-tested on Rocky Linux 10.
ansible-influxdb3
InfluxDB 3 Core on EL 10 from the vendor's release (checksum-verified), as a hardened systemd service on loopback with file object storage; the binary runs from its release directory (it links the Python it ships); the live test writes a point in line protocol and reads it back with SQL. Original role, live-tested on Rocky Linux 10.
ansible-mariadb-server
MariaDB bound to loopback (the package listens everywhere), with the mariadb-secure-installation steps applied by the role: anonymous users, the test database and remote root gone, LOAD DATA LOCAL off, reverse DNS off. Provisions an application database and a user that can see nothing else. Original role, live-tested on Rocky Linux 10.
ansible-meilisearch
Meilisearch on EL 10 from the vendor's release, pinned by a SHA-256 the role carries (the vendor publishes no checksum file), as a hardened systemd service on loopback in production mode behind a master key; the live test creates an index and documents, waits for the indexing task, searches and finds the one match, and sees a keyless request refused. Original role, live-tested on Rocky Linux 10.
ansible-opensearch
OpenSearch 3 (sha512-verified min distribution, bundled JDK), one node on EL 10 from the upstream release, as a hardened systemd service on loopback; the live test reads the root document, indexes one document with a refresh, finds it by a search, deletes the index and checks the keystore belongs to the service; the release tree stays read-only. Original role, live-tested on Rocky Linux 10.