From af11b18ed4309b1adfe1fca22b18f5aa9e93872b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alexandre=20D=2E=20D=C3=ADaz?=
 <alexandre.diaz@tecnativa.com>
Date: Wed, 22 Jun 2022 17:45:35 +0200
Subject: [PATCH 01/29] [UPD] pre-commit

---
 .pre-commit-config.yaml |  8 ++++----
 hooks/build             | 29 ++++++++++++++++-------------
 2 files changed, 20 insertions(+), 17 deletions(-)

diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 5d58ab6..469c467 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -2,11 +2,11 @@ default_language_version:
   python: python3
 repos:
 - repo: https://github.com/psf/black
-  rev: 19.3b0
+  rev: 22.3.0
   hooks:
   - id: black
 - repo: https://github.com/pre-commit/pre-commit-hooks
-  rev: v2.3.0
+  rev: v4.3.0
   hooks:
   - id: trailing-whitespace
   - id: end-of-file-fixer
@@ -21,10 +21,10 @@ repos:
   - id: mixed-line-ending
     args: ["--fix=lf"]
 - repo: https://github.com/asottile/seed-isort-config
-  rev: v1.9.3
+  rev: v2.2.0
   hooks:
   - id: seed-isort-config
 - repo: https://github.com/pre-commit/mirrors-isort
-  rev: v4.3.21
+  rev: v5.10.1
   hooks:
   - id: isort
diff --git a/hooks/build b/hooks/build
index b74f09f..d12dc4c 100755
--- a/hooks/build
+++ b/hooks/build
@@ -8,16 +8,19 @@ COMMIT = local.env.get("GIT_SHA1")
 DATE = date("--rfc-3339", "ns")
 
 # Build image
-docker[
-    "image",
-    "build",
-    "--build-arg",
-    "VCS_REF={}".format(COMMIT),
-    "--build-arg",
-    "BUILD_DATE={}".format(DATE),
-    "--build-arg",
-    "BASE_TAG={}".format(DOCKER_TAG),
-    "--tag",
-    "tecnativa/postgres-autoconf:{}".format(DOCKER_TAG),
-    ".",
-] & FG
+(
+    docker[
+        "image",
+        "build",
+        "--build-arg",
+        "VCS_REF={}".format(COMMIT),
+        "--build-arg",
+        "BUILD_DATE={}".format(DATE),
+        "--build-arg",
+        "BASE_TAG={}".format(DOCKER_TAG),
+        "--tag",
+        "tecnativa/postgres-autoconf:{}".format(DOCKER_TAG),
+        ".",
+    ]
+    & FG
+)

From c0d552c05defa1403713d69ba18689b78b401c0e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alexandre=20D=2E=20D=C3=ADaz?=
 <alexandre.diaz@tecnativa.com>
Date: Wed, 22 Jun 2022 17:49:06 +0200
Subject: [PATCH 02/29] [UPD] add pg14

---
 .github/workflows/ci.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index c3f41fc..5ef7d15 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -34,6 +34,7 @@ jobs:
       matrix:
         # Test modern Odoo versions with latest Postgres version
         pg_version:
+          - "14"
           - "13"
           - "12"
           - "11"

From 60ee4ce1c4a7173f5232b0e2d04ead6ce581f11a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alexandre=20D=2E=20D=C3=ADaz?=
 <alexandre.diaz@tecnativa.com>
Date: Wed, 22 Jun 2022 18:20:39 +0200
Subject: [PATCH 03/29] [FIX] tests

---
 .github/workflows/ci.yaml |  2 +-
 autoconf-entrypoint       | 21 +++++++++++++++------
 tests/test.py             |  4 ++--
 3 files changed, 18 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 5ef7d15..20bb358 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -55,7 +55,7 @@ jobs:
       # Build images
       - run: ./hooks/build
       # Test
-      - run: ./tests/test.py -v
+      - run: python -m unittest tests.test -v
       # Push
       - name: push to docker hub
         if: github.repository == 'Tecnativa/docker-postgres-autoconf' && github.ref == 'refs/heads/master'
diff --git a/autoconf-entrypoint b/autoconf-entrypoint
index b8e9cad..cbb8b49 100755
--- a/autoconf-entrypoint
+++ b/autoconf-entrypoint
@@ -30,6 +30,9 @@ WAN_DATABASES = json.loads(os.environ["WAN_DATABASES"])
 WAN_HBA_TPL = os.environ["WAN_HBA_TPL"]
 WAN_TLS = json.loads(os.environ["WAN_TLS"])
 WAN_USERS = json.loads(os.environ["WAN_USERS"])
+PGSSLCERT = os.environ.get("PGSSLCERT")
+PGSSLKEY = os.environ.get("PGSSLKEY")
+PGSSLROOTCERT = os.environ.get("PGSSLROOTCERT")
 
 # Configuration file templates
 CONF_FOLDER = "/etc/postgres"
@@ -56,23 +59,29 @@ hba_conf = []
 ssl_conf = []
 
 
-def permissions_fix(filename):
+def permissions_fix(filename, client=False):
     """Make :param:`filename` be owned by root user and postgres group."""
     shutil.chown(filename, "root", "postgres")
-    os.chmod(filename, stat.S_IRUSR | stat.S_IWUSR | stat.S_IRGRP)
+    if client:
+        os.chmod(filename, stat.S_IRUSR | stat.S_IWUSR)
+    else:
+        os.chmod(filename, stat.S_IRUSR | stat.S_IWUSR | stat.S_IRGRP)
 
 
 # Configure TLS
-for key, filename in SUPPORTED_CERTS.items():
-    full_path = os.path.join(CONF_FOLDER, filename)
+for key, filen in SUPPORTED_CERTS.items():
+    full_path = os.path.join(CONF_FOLDER, filen)
     # Write PEM file if it came from env variable
-    if not os.path.exists(full_path) and CERTS.get(filename):
+    if not os.path.exists(full_path) and CERTS.get(filen):
         with open(full_path, "w") as cert_file:
-            cert_file.write(CERTS[filename])
+            cert_file.write(CERTS[filen])
     if os.path.exists(full_path):
         # Enable file in postgres configuration
         ssl_conf.append("{} = '{}'".format(key, full_path))
         permissions_fix(full_path)
+for filen in (PGSSLCERT, PGSSLKEY, PGSSLROOTCERT):
+    if filen and os.path.exists(filen):
+        permissions_fix(filen, client=True)
 
 if ssl_conf:
     ssl_conf.append("ssl = on")
diff --git a/tests/test.py b/tests/test.py
index 5b1f760..f43ff18 100755
--- a/tests/test.py
+++ b/tests/test.py
@@ -27,8 +27,8 @@ def setUpClass(cls):
         with local.cwd(local.cwd / ".."):
             print("Building image")
             local["./hooks/build"] & FG
-        cls.image = "tecnativa/postgres-autoconf:{}".format(local.env["DOCKER_TAG"])
-        cls.cert_files = {"client.ca.cert.pem", "server.cert.pem", "server.key.pem"}
+        cls.image = f"tecnativa/postgres-autoconf:{local.env['DOCKER_TAG']}"
+        cls.cert_files = ("client.ca.cert.pem", "server.cert.pem", "server.key.pem")
         return super().setUpClass()
 
     def setUp(self):

From bb6d234cbe2ffa2d5e671856b1ae3f9533dc02d7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alexandre=20D=2E=20D=C3=ADaz?=
 <alexandre.diaz@tecnativa.com>
Date: Thu, 23 Jun 2022 21:36:27 +0200
Subject: [PATCH 04/29] [IMP] latest release

---
 .github/workflows/ci.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 20bb358..ff1c223 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -42,7 +42,7 @@ jobs:
           - "9.6"
     env:
       # Indicates what's the equivalent to tecnativa/postgres-autoconf:latest image
-      LATEST_RELEASE: "14.0"
+      LATEST_RELEASE: "14-alpine"
       # Variables found by default in Docker Hub builder
       DOCKER_REPO: tecnativa/postgres-autoconf
       DOCKER_TAG: ${{ matrix.pg_version }}-alpine

From 09942e81924cdb575f75d40a08731cfa657bc5f7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alexandre=20D=2E=20D=C3=ADaz?= <dev@redneboa.es>
Date: Tue, 14 Feb 2023 02:44:44 +0100
Subject: [PATCH 05/29] [ADD] ci: pg15

---
 .github/workflows/ci.yaml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index ff1c223..e16e095 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -34,6 +34,7 @@ jobs:
       matrix:
         # Test modern Odoo versions with latest Postgres version
         pg_version:
+          - "15"
           - "14"
           - "13"
           - "12"
@@ -42,7 +43,7 @@ jobs:
           - "9.6"
     env:
       # Indicates what's the equivalent to tecnativa/postgres-autoconf:latest image
-      LATEST_RELEASE: "14-alpine"
+      LATEST_RELEASE: "15-alpine"
       # Variables found by default in Docker Hub builder
       DOCKER_REPO: tecnativa/postgres-autoconf
       DOCKER_TAG: ${{ matrix.pg_version }}-alpine

From 78399430ff6e463f655e42a4cf6daeead1b8585b Mon Sep 17 00:00:00 2001
From: josep-tecnativa <josep.guardiola@tecnativa.com>
Date: Tue, 26 Sep 2023 10:54:00 +0200
Subject: [PATCH 06/29] [DCK] pre-commit dependencies updated

---
 .pre-commit-config.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 469c467..960b593 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -2,11 +2,11 @@ default_language_version:
   python: python3
 repos:
 - repo: https://github.com/psf/black
-  rev: 22.3.0
+  rev: 23.9.1
   hooks:
   - id: black
 - repo: https://github.com/pre-commit/pre-commit-hooks
-  rev: v4.3.0
+  rev: v4.4.0
   hooks:
   - id: trailing-whitespace
   - id: end-of-file-fixer

From 1b95106d814cd2c2bb005140e00b193eb8ccf9b3 Mon Sep 17 00:00:00 2001
From: josep-tecnativa <josep.guardiola@tecnativa.com>
Date: Mon, 7 Oct 2024 17:05:36 +0200
Subject: [PATCH 07/29] [ADD] pg16

---
 .github/workflows/ci.yaml | 3 ++-
 .pre-commit-config.yaml   | 4 ++--
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index e16e095..a131748 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -34,6 +34,7 @@ jobs:
       matrix:
         # Test modern Odoo versions with latest Postgres version
         pg_version:
+          - "16"
           - "15"
           - "14"
           - "13"
@@ -43,7 +44,7 @@ jobs:
           - "9.6"
     env:
       # Indicates what's the equivalent to tecnativa/postgres-autoconf:latest image
-      LATEST_RELEASE: "15-alpine"
+      LATEST_RELEASE: "16-alpine"
       # Variables found by default in Docker Hub builder
       DOCKER_REPO: tecnativa/postgres-autoconf
       DOCKER_TAG: ${{ matrix.pg_version }}-alpine
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 960b593..469c467 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -2,11 +2,11 @@ default_language_version:
   python: python3
 repos:
 - repo: https://github.com/psf/black
-  rev: 23.9.1
+  rev: 22.3.0
   hooks:
   - id: black
 - repo: https://github.com/pre-commit/pre-commit-hooks
-  rev: v4.4.0
+  rev: v4.3.0
   hooks:
   - id: trailing-whitespace
   - id: end-of-file-fixer

From 4eec7d8f0e7a94db6ec2acf7923d3a5571d01da1 Mon Sep 17 00:00:00 2001
From: josep-tecnativa <143796758+josep-tecnativa@users.noreply.github.com>
Date: Mon, 7 Oct 2024 17:16:56 +0200
Subject: [PATCH 08/29] Revert "Add postgres 16"

---
 .github/workflows/ci.yaml | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index a131748..e16e095 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -34,7 +34,6 @@ jobs:
       matrix:
         # Test modern Odoo versions with latest Postgres version
         pg_version:
-          - "16"
           - "15"
           - "14"
           - "13"
@@ -44,7 +43,7 @@ jobs:
           - "9.6"
     env:
       # Indicates what's the equivalent to tecnativa/postgres-autoconf:latest image
-      LATEST_RELEASE: "16-alpine"
+      LATEST_RELEASE: "15-alpine"
       # Variables found by default in Docker Hub builder
       DOCKER_REPO: tecnativa/postgres-autoconf
       DOCKER_TAG: ${{ matrix.pg_version }}-alpine

From 8e7eef9912b3b3cccef7064fc38016cd6d972719 Mon Sep 17 00:00:00 2001
From: josep-tecnativa <josep.guardiola@tecnativa.com>
Date: Mon, 7 Oct 2024 17:33:35 +0200
Subject: [PATCH 09/29] [FIX] apk add command based on
 https://github.com/Tecnativa/docker-postgres-autoconf/pull/18/commits/a89c10ed005ea1d37836abf15a8c36b5a3e975f2

---
 Dockerfile | 9 +--------
 1 file changed, 1 insertion(+), 8 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index c62cbda..209a1ea 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -19,14 +19,7 @@ ENV CERTS="{}" \
 RUN apk add --no-cache python3 \
     && mkdir -p /etc/postgres \
     && chmod a=rwx /etc/postgres
-RUN apk add --no-cache -t .build \
-        build-base \
-        linux-headers \
-        py3-pip \
-        python3-dev \
-    && pip3 install --no-cache-dir \
-        netifaces \
-    && apk del .build
+RUN apk add --no-cache py3-netifaces
 COPY autoconf-entrypoint /
 
 # Metadata

From c926d1a8c9d7adaac7b8fff5ff6415fe55000afb Mon Sep 17 00:00:00 2001
From: josep-tecnativa <josep.guardiola@tecnativa.com>
Date: Mon, 7 Oct 2024 17:44:49 +0200
Subject: [PATCH 10/29] [ADD] Postgres 16

---
 .github/workflows/ci.yaml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index e16e095..a131748 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -34,6 +34,7 @@ jobs:
       matrix:
         # Test modern Odoo versions with latest Postgres version
         pg_version:
+          - "16"
           - "15"
           - "14"
           - "13"
@@ -43,7 +44,7 @@ jobs:
           - "9.6"
     env:
       # Indicates what's the equivalent to tecnativa/postgres-autoconf:latest image
-      LATEST_RELEASE: "15-alpine"
+      LATEST_RELEASE: "16-alpine"
       # Variables found by default in Docker Hub builder
       DOCKER_REPO: tecnativa/postgres-autoconf
       DOCKER_TAG: ${{ matrix.pg_version }}-alpine

From 41e55585d32cd889962c74aedf92533cbebdb39f Mon Sep 17 00:00:00 2001
From: josep-tecnativa <josep.guardiola@tecnativa.com>
Date: Thu, 28 Nov 2024 16:41:51 +0100
Subject: [PATCH 11/29] [ADD] HBA_EXTRA_RULES support to allow custom
 pg_hba.conf rules

---
 Dockerfile          |  3 ++-
 README.md           | 13 +++++++++++++
 autoconf-entrypoint | 19 +++++++++++++++++++
 3 files changed, 34 insertions(+), 1 deletion(-)

diff --git a/Dockerfile b/Dockerfile
index 209a1ea..08b305e 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -15,7 +15,8 @@ ENV CERTS="{}" \
     WAN_DATABASES='["all"]' \
     WAN_HBA_TPL="{connection} {db} {user} {cidr} {meth}" \
     WAN_TLS=1 \
-    WAN_USERS='["all"]'
+    WAN_USERS='["all"]' \
+    HBA_EXTRA_RULES=""
 RUN apk add --no-cache python3 \
     && mkdir -p /etc/postgres \
     && chmod a=rwx /etc/postgres
diff --git a/README.md b/README.md
index 8aac63c..ba467bc 100644
--- a/README.md
+++ b/README.md
@@ -105,4 +105,17 @@ Wether to enable or not TLS in WAN connections.
 
 Users allowed to connect from WAN.
 
+#### `HBA_EXTRA_RULES`
+
+JSON array of additional pg_hba.conf rules to append. Each array element should be a string representing a valid pg_hba.conf line.
+
+Example HBA_EXTRA_RULES format in an .env file:
+
+HBA_EXTRA_RULES=["host all all 192.168.1.0/24 md5", "hostssl mydb myuser 10.0.0.0/8 scram-sha-256"]
+
+This adds the following lines to pg_hba.conf:
+
+host all all 192.168.1.0/24 md5
+hostssl mydb myuser 10.0.0.0/8 scram-sha-256
+
 [`Dockerfile`]: https://github.com/Tecnativa/docker-postgres-autoconf/blob/master/Dockerfile
diff --git a/autoconf-entrypoint b/autoconf-entrypoint
index cbb8b49..710526f 100755
--- a/autoconf-entrypoint
+++ b/autoconf-entrypoint
@@ -33,6 +33,7 @@ WAN_USERS = json.loads(os.environ["WAN_USERS"])
 PGSSLCERT = os.environ.get("PGSSLCERT")
 PGSSLKEY = os.environ.get("PGSSLKEY")
 PGSSLROOTCERT = os.environ.get("PGSSLROOTCERT")
+HBA_EXTRA_RULES = os.environ.get("HBA_EXTRA_RULES", "")
 
 # Configuration file templates
 CONF_FOLDER = "/etc/postgres"
@@ -86,6 +87,17 @@ for filen in (PGSSLCERT, PGSSLKEY, PGSSLROOTCERT):
 if ssl_conf:
     ssl_conf.append("ssl = on")
 
+# Parse extra rules for pg_hba.conf
+extra_hba_rules = []
+if HBA_EXTRA_RULES:
+    try:
+        extra_hba_rules = json.loads(HBA_EXTRA_RULES)
+        if not isinstance(extra_hba_rules, list):
+            raise ValueError("HBA_EXTRA_RULES must be a JSON array")
+    except json.JSONDecodeError:
+        print("Invalid JSON in HBA_EXTRA_RULES", file=sys.stderr)
+        sys.exit(1)
+
 # Generate LAN auth configuration
 for interface in netifaces.interfaces():
     for type_, addresses in netifaces.ifaddresses(interface).items():
@@ -123,6 +135,13 @@ if WAN_CONNECTION != "hostssl" or ssl_conf:
             )
         )
 
+# Append extra rules to hba_conf
+for rule in extra_hba_rules:
+    if not isinstance(rule, str):
+        print("Each rule in HBA_EXTRA_RULES must be a string", file=sys.stderr)
+        sys.exit(1)
+    hba_conf.append(rule)
+
 # Write postgres configuration files
 with open(CONF_FILE, "w") as conf_file:
     conf_file.write(

From 80ddfb7c6815395083b8170f7fdd397cd56a97b0 Mon Sep 17 00:00:00 2001
From: josep-tecnativa <josep.guardiola@tecnativa.com>
Date: Thu, 28 Nov 2024 16:49:27 +0100
Subject: [PATCH 12/29] [ADD] Tests to check if new feature works

---
 tests/test.py | 42 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 42 insertions(+)

diff --git a/tests/test.py b/tests/test.py
index f43ff18..4ab52a8 100755
--- a/tests/test.py
+++ b/tests/test.py
@@ -299,6 +299,48 @@ def test_certs_falsy_lan(self):
         with self.assertRaises(ProcessExecutionError):
             self._check_password_auth("example.localdomain")
 
+    def test_hba_extra_rules_added(self):
+        """Test that HBA_EXTRA_RULES lines are added to pg_hba.conf."""
+        if "9.6" in self.image:
+            self.skipTest("HBA_EXTRA_RULES not supported in PostgreSQL 9.6")
+        # Define custom HBA rules
+        hba_extra_rules = [
+            "host test_db custom_user 0.0.0.0/0 trust",
+            "hostssl all all 192.168.0.0/16 md5",
+        ]
+
+        # Start the Postgres container with HBA_EXTRA_RULES
+        self.postgres_container = docker(
+            "run",
+            "-d",
+            "--name",
+            "postgres_test_hba_extra_rules",
+            "--network",
+            "lan",
+            "-e",
+            "POSTGRES_DB=test_db",
+            "-e",
+            "POSTGRES_USER=test_user",
+            "-e",
+            "POSTGRES_PASSWORD=test_password",
+            "-e",
+            "HBA_EXTRA_RULES=" + json.dumps(hba_extra_rules),
+            CONF_EXTRA,
+            self.image,
+        ).strip()
+
+        # Give the container some time to initialize
+        time.sleep(10)
+
+        # Read the pg_hba.conf file content from the container
+        hba_conf = docker(
+            "exec", self.postgres_container, "cat", "/etc/postgres/pg_hba.conf"
+        ).strip()
+
+        # Check that each rule in hba_extra_rules is present in the file
+        for rule in hba_extra_rules:
+            self.assertIn(rule, hba_conf)
+
 
 if __name__ == "__main__":
     unittest.main()

From eba6aff02687eb239a45a53d04251066afd5c7d6 Mon Sep 17 00:00:00 2001
From: josep-tecnativa <josep.guardiola@tecnativa.com>
Date: Fri, 29 Nov 2024 08:34:10 +0100
Subject: [PATCH 13/29] [IMP] Add pushing PR images to be able to test it
 correctly

---
 .github/workflows/ci.yaml | 29 ++++++++++++++++++-----------
 1 file changed, 18 insertions(+), 11 deletions(-)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index a131748..925a15d 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -16,10 +16,8 @@ jobs:
       - uses: actions/checkout@v2
       - uses: actions/setup-python@v1
       - name: Set PY
-        run:
-          echo "PY=$(python -c 'import hashlib,
-          sys;print(hashlib.sha256(sys.version.encode()+sys.executable.encode()).hexdigest())')"
-          >> $GITHUB_ENV
+        run: |
+          echo "PY=$(python -c 'import hashlib,sys;print(hashlib.sha256(sys.version.encode()+sys.executable.encode()).hexdigest())')" >> $GITHUB_ENV
       - uses: actions/cache@v1
         with:
           path: ~/.cache/pre-commit
@@ -32,7 +30,6 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        # Test modern Odoo versions with latest Postgres version
         pg_version:
           - "16"
           - "15"
@@ -45,29 +42,39 @@ jobs:
     env:
       # Indicates what's the equivalent to tecnativa/postgres-autoconf:latest image
       LATEST_RELEASE: "16-alpine"
-      # Variables found by default in Docker Hub builder
       DOCKER_REPO: tecnativa/postgres-autoconf
       DOCKER_TAG: ${{ matrix.pg_version }}-alpine
       GIT_SHA1: ${{ github.sha }}
+      IS_PR: ${{ github.event_name == 'pull_request' }}
     steps:
-      # Prepare
       - uses: actions/checkout@v2
       - uses: actions/setup-python@v1
       - run: pip install -r tests/ci-requirements.txt
+
       # Build images
       - run: ./hooks/build
       # Test
       - run: python -m unittest tests.test -v
+      - name: Set Docker Tag
+        run: |
+          if [ "${{ env.IS_PR }}" = "true" ]; then
+            echo "DOCKER_TAG=${{ matrix.pg_version }}-test-pr${{ github.event.number }}" >> $GITHUB_ENV
+          else
+            echo "DOCKER_TAG=${{ matrix.pg_version }}-alpine" >> $GITHUB_ENV
+          fi
+      - name: Tag Docker Image for PR
+        if: env.IS_PR
+        run: docker tag ${{ env.DOCKER_REPO }}:${{ matrix.pg_version }}-alpine ${{ env.DOCKER_REPO }}:${{ env.DOCKER_TAG }}
       # Push
-      - name: push to docker hub
-        if: github.repository == 'Tecnativa/docker-postgres-autoconf' && github.ref == 'refs/heads/master'
+      - name: Push Docker Image to Docker Hub
+        if: github.repository == 'Tecnativa/docker-postgres-autoconf' && (env.IS_PR || github.ref == 'refs/heads/master')
         env:
           REGISTRY_HOST: docker.io
           REGISTRY_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
           REGISTRY_USERNAME: ${{ secrets.DOCKERHUB_LOGIN }}
         run: ./hooks/push
-      - name: push to github registry
-        if: github.repository == 'Tecnativa/docker-postgres-autoconf' && github.ref == 'refs/heads/master'
+      - name: Push Docker Image to GitHub Registry
+        if: github.repository == 'Tecnativa/docker-postgres-autoconf' && (env.IS_PR || github.ref == 'refs/heads/master')
         env:
           REGISTRY_HOST: ghcr.io
           REGISTRY_TOKEN: ${{ secrets.BOT_TOKEN }}

From bc6b537489f6e42ededf2b47eb293f2f387568c8 Mon Sep 17 00:00:00 2001
From: josep-tecnativa <josep.guardiola@tecnativa.com>
Date: Mon, 9 Dec 2024 12:29:32 +0100
Subject: [PATCH 14/29] [IMP] Reorder rules to certaintly apply extra hba rules

---
 autoconf-entrypoint | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/autoconf-entrypoint b/autoconf-entrypoint
index 710526f..3b8490e 100755
--- a/autoconf-entrypoint
+++ b/autoconf-entrypoint
@@ -51,6 +51,7 @@ local all all trust
 local replication all trust
 
 # LAN/WAN autogenerated configurations
+{extra_hba}
 {extra_conf}
 """
 WAN_CIDRS = ("0.0.0.0/0", "::0/0")
@@ -58,6 +59,7 @@ WAN_CIDRS = ("0.0.0.0/0", "::0/0")
 # Configuration helpers
 hba_conf = []
 ssl_conf = []
+extra_hba = []
 
 
 def permissions_fix(filename, client=False):
@@ -135,12 +137,12 @@ if WAN_CONNECTION != "hostssl" or ssl_conf:
             )
         )
 
-# Append extra rules to hba_conf
+# Append extra rules to extra_hba
 for rule in extra_hba_rules:
     if not isinstance(rule, str):
         print("Each rule in HBA_EXTRA_RULES must be a string", file=sys.stderr)
         sys.exit(1)
-    hba_conf.append(rule)
+    extra_hba.append(rule)
 
 # Write postgres configuration files
 with open(CONF_FILE, "w") as conf_file:
@@ -151,7 +153,9 @@ with open(CONF_FILE, "w") as conf_file:
     )
 permissions_fix(CONF_FILE)
 with open(HBA_FILE, "w") as conf_file:
-    conf_file.write(HBA_TPL.format(extra_conf="\n".join(hba_conf)))
+    conf_file.write(
+        HBA_TPL.format(extra_hba="\n".join(extra_hba), extra_conf="\n".join(hba_conf))
+    )
 permissions_fix(HBA_FILE)
 
 # Continue normal execution

From f8a09024b1b3dbd0383cd0e85c7d90187f069ee7 Mon Sep 17 00:00:00 2001
From: josep-tecnativa <josep.guardiola@tecnativa.com>
Date: Mon, 15 Sep 2025 13:59:04 +0200
Subject: [PATCH 15/29] [ADD] Psql 17

---
 .github/workflows/ci.yaml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 925a15d..d72a974 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -31,6 +31,7 @@ jobs:
       fail-fast: false
       matrix:
         pg_version:
+          - "17"
           - "16"
           - "15"
           - "14"
@@ -41,7 +42,7 @@ jobs:
           - "9.6"
     env:
       # Indicates what's the equivalent to tecnativa/postgres-autoconf:latest image
-      LATEST_RELEASE: "16-alpine"
+      LATEST_RELEASE: "17-alpine"
       DOCKER_REPO: tecnativa/postgres-autoconf
       DOCKER_TAG: ${{ matrix.pg_version }}-alpine
       GIT_SHA1: ${{ github.sha }}

From f59618b051b7b0f0425a6fe4b293bb3370c4ed8a Mon Sep 17 00:00:00 2001
From: josep-tecnativa <josep.guardiola@tecnativa.com>
Date: Mon, 15 Sep 2025 14:59:35 +0200
Subject: [PATCH 16/29] [FIX] Modernize CI

---
 .github/workflows/ci.yaml | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index d72a974..4325252 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -13,12 +13,12 @@ jobs:
   pre-commit:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
-      - uses: actions/setup-python@v1
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v6
       - name: Set PY
         run: |
           echo "PY=$(python -c 'import hashlib,sys;print(hashlib.sha256(sys.version.encode()+sys.executable.encode()).hexdigest())')" >> $GITHUB_ENV
-      - uses: actions/cache@v1
+      - uses: actions/cache@v4
         with:
           path: ~/.cache/pre-commit
           key: pre-commit|${{ env.PY }}|${{ hashFiles('.pre-commit-config.yaml') }}
@@ -48,8 +48,8 @@ jobs:
       GIT_SHA1: ${{ github.sha }}
       IS_PR: ${{ github.event_name == 'pull_request' }}
     steps:
-      - uses: actions/checkout@v2
-      - uses: actions/setup-python@v1
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v6
       - run: pip install -r tests/ci-requirements.txt
 
       # Build images

From 95614e5549aa862324ee67dfd155c74aad09caf1 Mon Sep 17 00:00:00 2001
From: josep-tecnativa <josep.guardiola@tecnativa.com>
Date: Fri, 26 Sep 2025 13:08:36 +0200
Subject: [PATCH 17/29] [ADD] Add pgvector library

---
 Dockerfile | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 08b305e..c823d7f 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -17,10 +17,12 @@ ENV CERTS="{}" \
     WAN_TLS=1 \
     WAN_USERS='["all"]' \
     HBA_EXTRA_RULES=""
-RUN apk add --no-cache python3 \
-    && mkdir -p /etc/postgres \
-    && chmod a=rwx /etc/postgres
-RUN apk add --no-cache py3-netifaces
+RUN apk add --no-cache python3 py3-netifaces \
+ && if [ "${PG_MAJOR:-0}" -ge 12 ]; then \
+        apk add --no-cache postgresql-pgvector; \
+    fi \
+ && mkdir -p /etc/postgres \
+ && chmod a=rwx /etc/postgres
 COPY autoconf-entrypoint /
 
 # Metadata

From aa1a78cf8a4f2aed752efdf193389858043d1a10 Mon Sep 17 00:00:00 2001
From: josep-tecnativa <josep.guardiola@tecnativa.com>
Date: Fri, 7 Nov 2025 13:33:50 +0100
Subject: [PATCH 18/29] [FIX] Skip push on fork PRs

---
 .github/workflows/ci.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 4325252..cf3332e 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -68,14 +68,14 @@ jobs:
         run: docker tag ${{ env.DOCKER_REPO }}:${{ matrix.pg_version }}-alpine ${{ env.DOCKER_REPO }}:${{ env.DOCKER_TAG }}
       # Push
       - name: Push Docker Image to Docker Hub
-        if: github.repository == 'Tecnativa/docker-postgres-autoconf' && (env.IS_PR || github.ref == 'refs/heads/master')
+        if: github.repository == 'Tecnativa/docker-postgres-autoconf' && (github.ref == 'refs/heads/master' || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository))
         env:
           REGISTRY_HOST: docker.io
           REGISTRY_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
           REGISTRY_USERNAME: ${{ secrets.DOCKERHUB_LOGIN }}
         run: ./hooks/push
       - name: Push Docker Image to GitHub Registry
-        if: github.repository == 'Tecnativa/docker-postgres-autoconf' && (env.IS_PR || github.ref == 'refs/heads/master')
+        if: github.repository == 'Tecnativa/docker-postgres-autoconf' && (github.ref == 'refs/heads/master' || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository))
         env:
           REGISTRY_HOST: ghcr.io
           REGISTRY_TOKEN: ${{ secrets.BOT_TOKEN }}

From 5d27541af9ed200f1d470cd55e6a367f8ce7711d Mon Sep 17 00:00:00 2001
From: JordiMForgeFlow <jordi.masvidal@forgeflow.com>
Date: Mon, 27 Oct 2025 11:30:37 +0100
Subject: [PATCH 19/29] [FIX] pgvector files: copy extension files to /local/
 folder

pgvector library files are stored under /usr/share and /usr/lib, but postgres is looking for extension files under /usr/local/share and /usr/local/lib.

With this change we move the extension files to the expected directories.
---
 Dockerfile | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/Dockerfile b/Dockerfile
index c823d7f..7737d53 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -20,6 +20,8 @@ ENV CERTS="{}" \
 RUN apk add --no-cache python3 py3-netifaces \
  && if [ "${PG_MAJOR:-0}" -ge 12 ]; then \
         apk add --no-cache postgresql-pgvector; \
+        cp /usr/share/postgresql/extension/vector* /usr/local/share/postgresql/extension/; \
+        cp /usr/lib/postgresql17/vector.so /usr/local/lib/postgresql/; \
     fi \
  && mkdir -p /etc/postgres \
  && chmod a=rwx /etc/postgres

From 8737a466654a3d14926d29787480f0d72f6dcb6c Mon Sep 17 00:00:00 2001
From: josep-tecnativa <josep.guardiola@tecnativa.com>
Date: Fri, 19 Dec 2025 12:03:44 +0100
Subject: [PATCH 20/29] [FIX] Build pgvector from source on Alpine

---
 Dockerfile | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 7737d53..0a940eb 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,5 @@
 ARG BASE_TAG
+ARG PGVECTOR_VERSION=0.8.1
 FROM docker.io/postgres:${BASE_TAG}
 ENTRYPOINT [ "/autoconf-entrypoint" ]
 CMD []
@@ -19,12 +20,18 @@ ENV CERTS="{}" \
     HBA_EXTRA_RULES=""
 RUN apk add --no-cache python3 py3-netifaces \
  && if [ "${PG_MAJOR:-0}" -ge 12 ]; then \
-        apk add --no-cache postgresql-pgvector; \
-        cp /usr/share/postgresql/extension/vector* /usr/local/share/postgresql/extension/; \
-        cp /usr/lib/postgresql17/vector.so /usr/local/lib/postgresql/; \
+        apk add --no-cache --virtual .pgvector-build build-base linux-headers ca-certificates; \
+        wget -qO- "https://github.com/pgvector/pgvector/archive/refs/tags/v${PGVECTOR_VERSION}.tar.gz" \
+          | tar -xz -C /tmp; \
+        cd "/tmp/pgvector-${PGVECTOR_VERSION}" \
+          && make PG_CONFIG=/usr/local/bin/pg_config \
+          && make install PG_CONFIG=/usr/local/bin/pg_config; \
+        cd / && rm -rf "/tmp/pgvector-${PGVECTOR_VERSION}"; \
+        apk del .pgvector-build; \
     fi \
  && mkdir -p /etc/postgres \
  && chmod a=rwx /etc/postgres
+
 COPY autoconf-entrypoint /
 
 # Metadata

From 5357fc9b190670bb508f33968982e904178589f5 Mon Sep 17 00:00:00 2001
From: josep-tecnativa <josep.guardiola@tecnativa.com>
Date: Wed, 24 Dec 2025 15:04:26 +0100
Subject: [PATCH 21/29] [ADD] PG 18

---
 .github/workflows/ci.yaml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index cf3332e..a33262c 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -31,6 +31,7 @@ jobs:
       fail-fast: false
       matrix:
         pg_version:
+          - "18"
           - "17"
           - "16"
           - "15"
@@ -42,7 +43,7 @@ jobs:
           - "9.6"
     env:
       # Indicates what's the equivalent to tecnativa/postgres-autoconf:latest image
-      LATEST_RELEASE: "17-alpine"
+      LATEST_RELEASE: "18-alpine"
       DOCKER_REPO: tecnativa/postgres-autoconf
       DOCKER_TAG: ${{ matrix.pg_version }}-alpine
       GIT_SHA1: ${{ github.sha }}

From 6b50875e885367a4f800ca466ef69470fb14f0a6 Mon Sep 17 00:00:00 2001
From: josep-tecnativa <josep.guardiola@tecnativa.com>
Date: Mon, 19 Jan 2026 15:12:33 +0100
Subject: [PATCH 22/29] [FIX] Define correctly PGVECTOR_VERSION

---
 Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Dockerfile b/Dockerfile
index 0a940eb..f24e48d 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,8 +1,8 @@
 ARG BASE_TAG
-ARG PGVECTOR_VERSION=0.8.1
 FROM docker.io/postgres:${BASE_TAG}
 ENTRYPOINT [ "/autoconf-entrypoint" ]
 CMD []
+ARG PGVECTOR_VERSION=0.8.1
 ENV CERTS="{}" \
     CONF_EXTRA="" \
     LAN_AUTH_METHOD=md5 \

From 66241e4defc9a560aa0d0a0743f2b9faabc3af60 Mon Sep 17 00:00:00 2001
From: Simon Pessemesse <simon@auneor-conseil.fr>
Date: Tue, 3 Mar 2026 12:24:39 +0100
Subject: [PATCH 23/29] [FIX] fix alpine dependencies for pg_vector compilation

---
 Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Dockerfile b/Dockerfile
index f24e48d..e5260c5 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -20,7 +20,7 @@ ENV CERTS="{}" \
     HBA_EXTRA_RULES=""
 RUN apk add --no-cache python3 py3-netifaces \
  && if [ "${PG_MAJOR:-0}" -ge 12 ]; then \
-        apk add --no-cache --virtual .pgvector-build build-base linux-headers ca-certificates; \
+        apk add --no-cache --virtual .pgvector-build build-base clang19 llvm19 linux-headers ca-certificates; \
         wget -qO- "https://github.com/pgvector/pgvector/archive/refs/tags/v${PGVECTOR_VERSION}.tar.gz" \
           | tar -xz -C /tmp; \
         cd "/tmp/pgvector-${PGVECTOR_VERSION}" \

From 79d281e86bac9649aadd6ef95ab54b0cdae6b5cb Mon Sep 17 00:00:00 2001
From: Liam Noonan <ljmnoonan@gmail.com>
Date: Mon, 1 Jun 2026 02:54:53 +0000
Subject: [PATCH 24/29] [IMP] Build Multiarch images in CI The ultimate goal of
 this commit is to support building arm64, but I wound up changing a few
 different things along the way as well. First of all, we build the image for
 both architectures in one step, but then we have to push it to a local
 registry in order to pull each architecture and test. Then, once the tests
 have passed, we re-tag the image or manifest from the local registry and push
 it to ghcr and Dockerhub (if Dockerhub credentials exist). Not essential to
 this task, but very beneficial for myself and any future contributors, I have
 made the whole thing repo agnostic, so anyone can just fork and test, no CI
 customization required.

---
 .github/workflows/ci.yaml | 61 ++++++++++++++++++++++++++-------------
 hooks/build               | 52 ++++++++++++++++++++++-----------
 hooks/push                | 30 ++++++++++---------
 tests/test.py             | 29 ++++++++++++++-----
 4 files changed, 115 insertions(+), 57 deletions(-)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index a33262c..988994f 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -25,8 +25,17 @@ jobs:
       - uses: pre-commit/action@v1.0.1
 
   build-test-push:
+    if: github.ref == format('refs/heads/{0}', github.event.repository.default_branch) || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository)
     runs-on: ubuntu-latest
     needs: pre-commit
+    permissions:
+      contents: read
+      packages: write
+    services:
+      registry:
+        image: registry:3
+        ports:
+          - 5000:5000
     strategy:
       fail-fast: false
       matrix:
@@ -42,43 +51,55 @@ jobs:
           - "10"
           - "9.6"
     env:
+      DOCKER_PLATFORM: linux/amd64,linux/arm64
+      LOCAL_REGISTRY: localhost:5000
       # Indicates what's the equivalent to tecnativa/postgres-autoconf:latest image
       LATEST_RELEASE: "18-alpine"
-      DOCKER_REPO: tecnativa/postgres-autoconf
-      DOCKER_TAG: ${{ matrix.pg_version }}-alpine
+      DOCKER_REPO: ${{ github.repository == 'Tecnativa/docker-postgres-autoconf' && 'tecnativa/postgres-autoconf' || github.repository }}
+      BASE_TAG: ${{ matrix.pg_version }}-alpine
+      DOCKER_TAG: ${{ github.event_name == 'pull_request' && format('{0}-test-pr{1}', matrix.pg_version, github.event.number) || format('{0}-alpine', matrix.pg_version) }}
       GIT_SHA1: ${{ github.sha }}
-      IS_PR: ${{ github.event_name == 'pull_request' }}
+      # Github does not allow evaluating a secret in an if condition, so we need to set them as environment variables
+      DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
+      DOCKERHUB_LOGIN: ${{ secrets.DOCKERHUB_LOGIN }}
     steps:
+      # Image repo names have to be lowercase.
+      - name: Lowercase image repository name
+        run: |
+            DOCKER_REPO=${DOCKER_REPO,,}
+            echo "DOCKER_REPO=$DOCKER_REPO" >> "$GITHUB_ENV"
       - uses: actions/checkout@v4
       - uses: actions/setup-python@v6
       - run: pip install -r tests/ci-requirements.txt
 
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v4
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+        with:
+          driver-opts: network=host
       # Build images
-      - run: ./hooks/build
+      - name: Build images
+        run: ./hooks/build
       # Test
-      - run: python -m unittest tests.test -v
-      - name: Set Docker Tag
+      - name: Test each platform
         run: |
-          if [ "${{ env.IS_PR }}" = "true" ]; then
-            echo "DOCKER_TAG=${{ matrix.pg_version }}-test-pr${{ github.event.number }}" >> $GITHUB_ENV
-          else
-            echo "DOCKER_TAG=${{ matrix.pg_version }}-alpine" >> $GITHUB_ENV
-          fi
-      - name: Tag Docker Image for PR
-        if: env.IS_PR
-        run: docker tag ${{ env.DOCKER_REPO }}:${{ matrix.pg_version }}-alpine ${{ env.DOCKER_REPO }}:${{ env.DOCKER_TAG }}
+          IFS=',' read -ra PLATFORMS <<< "$DOCKER_PLATFORM"
+          for platform in "${PLATFORMS[@]}"; do
+            echo "Testing platform: $platform"
+            TEST_PLATFORM="$platform" python -m unittest tests.test -v
+          done
       # Push
       - name: Push Docker Image to Docker Hub
-        if: github.repository == 'Tecnativa/docker-postgres-autoconf' && (github.ref == 'refs/heads/master' || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository))
+        if: env.DOCKERHUB_TOKEN && env.DOCKERHUB_LOGIN
         env:
           REGISTRY_HOST: docker.io
-          REGISTRY_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
-          REGISTRY_USERNAME: ${{ secrets.DOCKERHUB_LOGIN }}
+          REGISTRY_TOKEN: ${{ env.DOCKERHUB_TOKEN }}
+          REGISTRY_USERNAME: ${{ env.DOCKERHUB_LOGIN }}
         run: ./hooks/push
       - name: Push Docker Image to GitHub Registry
-        if: github.repository == 'Tecnativa/docker-postgres-autoconf' && (github.ref == 'refs/heads/master' || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository))
         env:
           REGISTRY_HOST: ghcr.io
-          REGISTRY_TOKEN: ${{ secrets.BOT_TOKEN }}
-          REGISTRY_USERNAME: ${{ secrets.BOT_LOGIN }}
+          REGISTRY_TOKEN: ${{ secrets.BOT_TOKEN || secrets.GITHUB_TOKEN }}
+          REGISTRY_USERNAME: ${{ secrets.BOT_LOGIN || github.repository_owner }}
         run: ./hooks/push
diff --git a/hooks/build b/hooks/build
index d12dc4c..d205ad7 100755
--- a/hooks/build
+++ b/hooks/build
@@ -3,24 +3,42 @@ from plumbum import FG, local
 from plumbum.cmd import date, docker
 
 # Check environment variables are present
+DOCKER_PLATFORM = local.env.get("DOCKER_PLATFORM", "linux/amd64")
 DOCKER_TAG = local.env["DOCKER_TAG"]
+BASE_TAG = local.env.get("BASE_TAG", DOCKER_TAG)
+REPO = local.env["DOCKER_REPO"]
 COMMIT = local.env.get("GIT_SHA1")
 DATE = date("--rfc-3339", "ns")
-
-# Build image
-(
-    docker[
-        "image",
-        "build",
-        "--build-arg",
-        "VCS_REF={}".format(COMMIT),
-        "--build-arg",
-        "BUILD_DATE={}".format(DATE),
-        "--build-arg",
-        "BASE_TAG={}".format(DOCKER_TAG),
-        "--tag",
-        "tecnativa/postgres-autoconf:{}".format(DOCKER_TAG),
-        ".",
-    ]
-    & FG
+LOCAL_REGISTRY = local.env.get("LOCAL_REGISTRY")
+IMAGE = (
+    "%s/%s:%s" % (LOCAL_REGISTRY, REPO, DOCKER_TAG)
+    if LOCAL_REGISTRY
+    else "%s:%s" % (REPO, DOCKER_TAG)
 )
+PLATFORMS = [p.strip() for p in DOCKER_PLATFORM.split(",") if p.strip()]
+
+build = docker[
+    "buildx",
+    "build",
+    "--platform",
+    DOCKER_PLATFORM,
+    "--build-arg",
+    "VCS_REF={}".format(COMMIT),
+    "--build-arg",
+    "BUILD_DATE={}".format(DATE),
+    "--build-arg",
+    "BASE_TAG={}".format(BASE_TAG),
+    "--tag",
+    IMAGE,
+    ".",
+]
+if LOCAL_REGISTRY:
+    build = build["--push"]
+elif len(PLATFORMS) == 1:
+    build = build["--load"]
+else:
+    raise SystemExit(
+        "Multi-platform builds require LOCAL_REGISTRY; "
+        "set DOCKER_PLATFORM to one value for local --load builds."
+    )
+(build & FG)
diff --git a/hooks/push b/hooks/push
index 2c6a70b..fe7d927 100755
--- a/hooks/push
+++ b/hooks/push
@@ -7,10 +7,20 @@ REPO = local.env["DOCKER_REPO"]
 SUFFIX = local.env.get("DOCKER_REPO_SUFFIX", "")
 VERSION = local.env["DOCKER_TAG"]
 
-# Log all locally available images; will help to pin images
-docker["image", "ls", "--digests", REPO] & FG
 
-# Login in Docker Hub
+def image_ref(registry, tag):
+    return "%s/%s%s:%s" % (registry, REPO, SUFFIX, tag)
+
+
+source = image_ref(local.env["LOCAL_REGISTRY"], VERSION)
+dest_tags = [image_ref(REGISTRY, VERSION)]
+if VERSION == local.env.get("LATEST_RELEASE"):
+    latest = "alpine" if VERSION.endswith("-alpine") else "latest"
+    dest_tags.append(image_ref(REGISTRY, latest))
+
+docker["buildx", "imagetools", "inspect", source] & FG
+
+# Login in Docker Hub or ghcr
 docker(
     "login",
     "--username",
@@ -20,13 +30,7 @@ docker(
     REGISTRY,
 )
 
-# Push built images
-local_image = "%s:%s" % (REPO, VERSION)
-public_image = "%s/%s%s:%s" % (REGISTRY, REPO, SUFFIX, VERSION)
-docker["image", "tag", local_image, public_image] & FG
-docker["image", "push", public_image] & FG
-if VERSION == local.env.get("LATEST_RELEASE"):
-    latest_version = "alpine" if VERSION.endswith("-alpine") else "latest"
-    public_image = "%s/%s%s:%s" % (REGISTRY, REPO, SUFFIX, latest_version)
-    docker["image", "tag", local_image, public_image] & FG
-    docker["image", "push", public_image] & FG
+promote = docker["buildx", "imagetools", "create"]
+for dest in dest_tags:
+    promote = promote["-t", dest]
+(promote[source] & FG)
diff --git a/tests/test.py b/tests/test.py
index 4ab52a8..c0e9966 100755
--- a/tests/test.py
+++ b/tests/test.py
@@ -22,12 +22,19 @@
 class PostgresAutoconfCase(unittest.TestCase):
     """Test behavior for this docker image"""
 
+    @classmethod
+    def _platform_args(cls):
+        platform = os.environ.get("TEST_PLATFORM")
+        if platform:
+            return ("--platform", platform)
+        return ()
+
     @classmethod
     def setUpClass(cls):
-        with local.cwd(local.cwd / ".."):
-            print("Building image")
-            local["./hooks/build"] & FG
-        cls.image = f"tecnativa/postgres-autoconf:{local.env['DOCKER_TAG']}"
+        registry = local.env.get("LOCAL_REGISTRY")
+        repo = local.env.get("DOCKER_REPO", "tecnativa/postgres-autoconf")
+        tag = local.env["DOCKER_TAG"]
+        cls.image = f"{registry}/{repo}:{tag}" if registry else f"{repo}:{tag}"
         cls.cert_files = ("client.ca.cert.pem", "server.cert.pem", "server.key.pem")
         return super().setUpClass()
 
@@ -56,7 +63,7 @@ def _check_local_connection(self):
         # The 1st test could fail while postgres boots
         for attempt in range(10):
             try:
-                time.sleep(5)
+                time.sleep(15)
                 # Test local connections via unix socket work
                 self.assertEqual(
                     "1\n",
@@ -75,13 +82,13 @@ def _check_local_connection(self):
                         "test_user",
                     ),
                 )
-            except AssertionError:
+            except (AssertionError, ProcessExecutionError):
                 if attempt < 9:
                     print("Failure number {}. Retrying...".format(attempt))
                 else:
                     raise
             else:
-                continue
+                return
 
     def _check_password_auth(self, host=None):
         """Test connection with password auth work fine."""
@@ -93,6 +100,7 @@ def _check_password_auth(self, host=None):
             docker(
                 "container",
                 "run",
+                *self._platform_args(),
                 "--network",
                 "lan",
                 "-e",
@@ -126,6 +134,7 @@ def _check_cert_auth(self):
             docker(
                 "container",
                 "run",
+                *self._platform_args(),
                 "--network",
                 "wan",
                 "-e",
@@ -163,6 +172,7 @@ def test_server_certs_var(self):
                 self.postgres_container = docker(
                     "container",
                     "run",
+                    *self._platform_args(),
                     "-d",
                     "--network",
                     "lan",
@@ -198,6 +208,7 @@ def test_server_certs_mount(self):
                 self.postgres_container = docker(
                     "container",
                     "run",
+                    *self._platform_args(),
                     "-d",
                     "--network",
                     "lan",
@@ -221,6 +232,7 @@ def test_no_certs_lan(self):
         self.postgres_container = docker(
             "container",
             "run",
+            *self._platform_args(),
             "-d",
             "--network",
             "lan",
@@ -244,6 +256,7 @@ def test_no_certs_wan(self):
         self.postgres_container = docker(
             "container",
             "run",
+            *self._platform_args(),
             "-d",
             "--network",
             "lan",
@@ -271,6 +284,7 @@ def test_certs_falsy_lan(self):
         self.postgres_container = docker(
             "container",
             "run",
+            *self._platform_args(),
             "-d",
             "--network",
             "lan",
@@ -312,6 +326,7 @@ def test_hba_extra_rules_added(self):
         # Start the Postgres container with HBA_EXTRA_RULES
         self.postgres_container = docker(
             "run",
+            *self._platform_args(),
             "-d",
             "--name",
             "postgres_test_hba_extra_rules",

From 74192dcd6d8f28bdbf704a510a0fc6bf7b3ed37e Mon Sep 17 00:00:00 2001
From: Liam Noonan <ljmnoonan@gmail.com>
Date: Tue, 9 Jun 2026 18:41:45 +0000
Subject: [PATCH 25/29] [FIX] Bump actions/checkout and actions/cache Node.js
 20 is EOL, so we need to move to actions that support node.js 24
 pre-commit/action should also be updated, but it seems the pre-commit team
 has abandoned this Github action in favor of their https://pre-commit.ci/
 service. This will have to wait for another time.

---
 .github/workflows/ci.yaml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 988994f..3ffd4ea 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -13,12 +13,12 @@ jobs:
   pre-commit:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: actions/setup-python@v6
       - name: Set PY
         run: |
           echo "PY=$(python -c 'import hashlib,sys;print(hashlib.sha256(sys.version.encode()+sys.executable.encode()).hexdigest())')" >> $GITHUB_ENV
-      - uses: actions/cache@v4
+      - uses: actions/cache@v5
         with:
           path: ~/.cache/pre-commit
           key: pre-commit|${{ env.PY }}|${{ hashFiles('.pre-commit-config.yaml') }}
@@ -68,7 +68,7 @@ jobs:
         run: |
             DOCKER_REPO=${DOCKER_REPO,,}
             echo "DOCKER_REPO=$DOCKER_REPO" >> "$GITHUB_ENV"
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: actions/setup-python@v6
       - run: pip install -r tests/ci-requirements.txt
 

From 49178e7bd7ef685ac88bc2b652e1da2a742561e8 Mon Sep 17 00:00:00 2001
From: Liam Noonan <ljmnoonan@gmail.com>
Date: Sat, 6 Jun 2026 22:00:48 +0000
Subject: [PATCH 26/29] [FIX] Fix or get rid of broken repo badges

---
 README.md | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/README.md b/README.md
index ba467bc..a90e964 100644
--- a/README.md
+++ b/README.md
@@ -1,10 +1,8 @@
 # PostgreSQL Auto-Conf
 
-[![Build Status](https://travis-ci.org/Tecnativa/docker-postgres-autoconf.svg?branch=master)](https://travis-ci.org/Tecnativa/docker-postgres-autoconf)
+[![Build Status](../../actions/workflows/ci.yaml/badge.svg?branch=master)](../../actions/workflows/ci.yaml)
 [![Docker Pulls](https://img.shields.io/docker/pulls/tecnativa/postgres-autoconf.svg)](https://hub.docker.com/r/tecnativa/postgres-autoconf)
-[![Layers](https://images.microbadger.com/badges/image/tecnativa/postgres-autoconf.svg)](https://microbadger.com/images/tecnativa/postgres-autoconf)
-[![Commit](https://images.microbadger.com/badges/commit/tecnativa/postgres-autoconf.svg)](https://microbadger.com/images/tecnativa/postgres-autoconf)
-[![License](https://img.shields.io/github/license/Tecnativa/docker-postgres-autoconf.svg)](https://github.com/Tecnativa/docker-postgres-autoconf/blob/master/LICENSE)
+[![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](../../blob/master/LICENSE)
 
 ## What
 

From 311d76e2dfc017202a3d231f2f240b28d7c2d1e2 Mon Sep 17 00:00:00 2001
From: Liam Noonan <ljmnoonan@gmail.com>
Date: Mon, 6 Jul 2026 12:33:12 +0000
Subject: [PATCH 27/29] Fix clang/llvm Base for Postgres 14-18 was bumped from
 alpine v3.23 to v3.24 in docker-library/official-images@769849f

Alpine v3.24 dropped support for clang19/llvm19, which caused
pgvector-build to fail for versions 14 and up.

As it turns out, using hardcoded clang19/llvm19 was already not the best idea
as it did not match the version used by postgres itself. Only postgres 13
uses clang19 and llvm19, everything above uses clang21 and llvm21.

Also, pgvector 0.8.1 does not support pg12
https://github.com/pgvector/pgvector/blob/fb1b8966ebb9254032b6d0e7a594fdcc86f8efcc/CHANGELOG.md?plain=1#L34

Ultimately, I beleive pgvector was only properly installed in a few versions.
This commit makes sure it is installed from 13 upwards and also tests that
it is installed and working.
---
 Dockerfile    |  7 ++++--
 tests/test.py | 67 +++++++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 72 insertions(+), 2 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index e5260c5..5b0fcd2 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -19,8 +19,11 @@ ENV CERTS="{}" \
     WAN_USERS='["all"]' \
     HBA_EXTRA_RULES=""
 RUN apk add --no-cache python3 py3-netifaces \
- && if [ "${PG_MAJOR:-0}" -ge 12 ]; then \
-        apk add --no-cache --virtual .pgvector-build build-base clang19 llvm19 linux-headers ca-certificates; \
+ && if [ "${PG_MAJOR:-0}" -ge 13 ]; then \
+        PG_CLANG="$(pg_config --configure | tr "'" "\n" | sed -n 's/^CLANG=clang-//p')"; \
+        PG_LLVM="$(pg_config --configure | tr "'" "\n" | sed -n 's#^LLVM_CONFIG=/usr/lib/llvm\([0-9][0-9]*\)/bin/llvm-config#\1#p')"; \
+        test -n "${PG_CLANG}" && test -n "${PG_LLVM}" && test "${PG_CLANG}" = "${PG_LLVM}"; \
+        apk add --no-cache --virtual .pgvector-build build-base linux-headers ca-certificates "clang${PG_CLANG}" "llvm${PG_LLVM}"; \
         wget -qO- "https://github.com/pgvector/pgvector/archive/refs/tags/v${PGVECTOR_VERSION}.tar.gz" \
           | tar -xz -C /tmp; \
         cd "/tmp/pgvector-${PGVECTOR_VERSION}" \
diff --git a/tests/test.py b/tests/test.py
index c0e9966..8111807 100755
--- a/tests/test.py
+++ b/tests/test.py
@@ -356,6 +356,73 @@ def test_hba_extra_rules_added(self):
         for rule in hba_extra_rules:
             self.assertIn(rule, hba_conf)
 
+    def test_pgvector_extension(self):
+        """Test that pgvector is installed and works."""
+        if float(local.env["DOCKER_TAG"].split("-")[0]) < 13:
+            self.skipTest("pgvector not built for PostgreSQL < 13")
+        self.postgres_container = docker(
+            "container",
+            "run",
+            "-d",
+            "--network",
+            "lan",
+            "-e",
+            "POSTGRES_DB=test_db",
+            "-e",
+            "POSTGRES_PASSWORD=test_password",
+            "-e",
+            "POSTGRES_USER=test_user",
+            CONF_EXTRA,
+            self.image,
+        ).strip()
+        self._check_local_connection()
+        self.assertEqual(
+            "vector\n",
+            docker(
+                "container",
+                "exec",
+                self.postgres_container,
+                "psql",
+                "--command",
+                "SELECT name FROM pg_available_extensions WHERE name = 'vector';",
+                "--dbname",
+                "test_db",
+                "--no-align",
+                "--tuples-only",
+                "--username",
+                "test_user",
+            ),
+        )
+        docker(
+            "container",
+            "exec",
+            self.postgres_container,
+            "psql",
+            "--command",
+            "CREATE EXTENSION vector;",
+            "--dbname",
+            "test_db",
+            "--username",
+            "test_user",
+        )
+        self.assertEqual(
+            "1\n",
+            docker(
+                "container",
+                "exec",
+                self.postgres_container,
+                "psql",
+                "--command",
+                "SELECT ('[1,2,3]'::vector <-> '[1,2,4]'::vector)::int;",
+                "--dbname",
+                "test_db",
+                "--no-align",
+                "--tuples-only",
+                "--username",
+                "test_user",
+            ),
+        )
+
 
 if __name__ == "__main__":
     unittest.main()

From 85f46b5fc5ddb80e77ebe84936820506ac678600 Mon Sep 17 00:00:00 2001
From: Jairo Llopis <jairo@moduon.team>
Date: Mon, 22 Jun 2026 11:52:09 +0100
Subject: [PATCH 28/29] ci: run build-test-push on all PRs and fix ghcr push
 auth

Fork PRs previously skipped the build-test-push job entirely,
preventing contributors from getting build and test feedback.

The GHCR push step used || between independent secrets:
BOT_TOKEN || GITHUB_TOKEN and BOT_LOGIN || repository_owner.
When only one BOT_* secret was set, credentials became a mismatched
pair, causing a denied: denied authentication failure from ghcr.io.

Changes:
- Remove same-repo restriction from job condition so all PRs
  run the pipeline.
- Use && to ensure both BOT_TOKEN and BOT_LOGIN must exist
  together to be used; otherwise fall back to the always-
  available GITHUB_TOKEN + github.repository_owner pair.
- Expose BOT_TOKEN and BOT_LOGIN as env vars so they can be
  evaluated in the if: condition.
- Allow GHCR push on fork PRs when bot credentials are
  available; skip only when GITHUB_TOKEN would be read-only
  (fork PR without BOT_TOKEN/BOT_LOGIN).
- Use github.repository_owner as fallback username instead of
  github.actor to avoid confusion in org fork scenarios.
---
 .github/workflows/ci.yaml | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 3ffd4ea..6112667 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -25,7 +25,7 @@ jobs:
       - uses: pre-commit/action@v1.0.1
 
   build-test-push:
-    if: github.ref == format('refs/heads/{0}', github.event.repository.default_branch) || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository)
+    if: github.ref == format('refs/heads/{0}', github.event.repository.default_branch) || github.event_name == 'pull_request'
     runs-on: ubuntu-latest
     needs: pre-commit
     permissions:
@@ -62,6 +62,8 @@ jobs:
       # Github does not allow evaluating a secret in an if condition, so we need to set them as environment variables
       DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
       DOCKERHUB_LOGIN: ${{ secrets.DOCKERHUB_LOGIN }}
+      BOT_TOKEN: ${{ secrets.BOT_TOKEN }}
+      BOT_LOGIN: ${{ secrets.BOT_LOGIN }}
     steps:
       # Image repo names have to be lowercase.
       - name: Lowercase image repository name
@@ -98,8 +100,9 @@ jobs:
           REGISTRY_USERNAME: ${{ env.DOCKERHUB_LOGIN }}
         run: ./hooks/push
       - name: Push Docker Image to GitHub Registry
+        if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository || env.BOT_TOKEN && env.BOT_LOGIN
         env:
           REGISTRY_HOST: ghcr.io
-          REGISTRY_TOKEN: ${{ secrets.BOT_TOKEN || secrets.GITHUB_TOKEN }}
-          REGISTRY_USERNAME: ${{ secrets.BOT_LOGIN || github.repository_owner }}
+          REGISTRY_TOKEN: ${{ secrets.BOT_LOGIN && secrets.BOT_TOKEN || secrets.GITHUB_TOKEN }}
+          REGISTRY_USERNAME: ${{ secrets.BOT_TOKEN && secrets.BOT_LOGIN || github.repository_owner }}
         run: ./hooks/push

From 89cd20cbd5cd604a9fe3999cfb366e5a3d5e89fb Mon Sep 17 00:00:00 2001
From: Jairo Llopis <jairo@moduon.team>
Date: Fri, 12 Jun 2026 10:36:08 +0100
Subject: [PATCH 29/29] fix(pgvector): target x86-64-v2 for CPU portability
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Without explicit CFLAGS, make detects the host CPU features (e.g. AVX-512)
and generates a .so that crashes with "signal 4: Illegal instruction"
on older x86-64 CPUs.

Pinning -march=x86-64-v2 ensures compatibility with any x86-64
processor from the last ~15 years.

Without this patch, for example you cannot install PGVector if your server
runs an Intel® i9-13900 processor.

ARM64 builds are not affected.

@moduon MT-14612
---
 Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Dockerfile b/Dockerfile
index 5b0fcd2..af49463 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -27,7 +27,7 @@ RUN apk add --no-cache python3 py3-netifaces \
         wget -qO- "https://github.com/pgvector/pgvector/archive/refs/tags/v${PGVECTOR_VERSION}.tar.gz" \
           | tar -xz -C /tmp; \
         cd "/tmp/pgvector-${PGVECTOR_VERSION}" \
-          && make PG_CONFIG=/usr/local/bin/pg_config \
+          && make $(if [ "$(uname -m)" = "x86_64" ]; then echo 'CFLAGS=-march=x86-64-v2'; fi) PG_CONFIG=/usr/local/bin/pg_config \
           && make install PG_CONFIG=/usr/local/bin/pg_config; \
         cd / && rm -rf "/tmp/pgvector-${PGVECTOR_VERSION}"; \
         apk del .pgvector-build; \