peer authentication

A pg_hba.conf method available only on local lines, the ones for the Unix socket /var/run/postgresql/.s.PGSQL.5432: the server asks the kernel which system user sits at the other end and requires that name to match the role being asked for. No password travels, and none even has to exist. That is why sudo -u postgres psql gets in, and why the same command without sudo answers FATAL: Peer authentication failed for user "postgres". Taking that working psql as proof that authentication is sorted costs you the deployment: the application connects to 127.0.0.1, matches a host line, has to supply a password hashed with scram-sha-256, and gets password authentication failed for a role whose password nobody ever set. peer attests a system identity, nothing more.