Reposted by @compy3.bsky.social
I've used postgres for years and just took their authentication for granted. Now that I'm looking at it, I realize it's a bit of a frankenstein with three separate layers in play. And also not conducive to building a proxy around it, which explains why pgbouncer uses it's own auth file.