Configure PostgreSQL 16 (Hardened)

Configuration files

/etc/postgresql/16/main/postgresql.conf and pg_hba.conf

Credential rotation

Create application roles with your own passwords: CREATE ROLE app LOGIN PASSWORD '...';

Monitoring & logging

• Logs: /var/log/postgresql/postgresql-16-main.log; `journalctl -u postgresql -f`
• Health: sudo -u postgres pg_isready → 'accepting connections' — wire this into your cloud's monitoring agent or an external probe.
• Cloud-native agents (CloudWatch agent, Google Cloud Ops Agent) install normally on this image if you want metrics/log shipping — none is pre-installed or phoning home by default.

Upgrades

Replace with the newest image version (monthly rebuild cadence), or `apt upgrade postgresql-16` / `dnf update` in place. Major-version upgrades via pg_upgrade — snapshot first.

Backup & restore

pg_dumpall via `sudo -u postgres pg_dumpall > backup.sql`, or stop the service and snapshot the volume.