nixos/postgresql: change option enableTCPIP to actually mean TCP/IP.

nixos/modules/services/databases/postgresql.nix

@@ -361,12 +361,25 @@ in
       };
 
       enableTCPIP = mkOption {
-        type = types.bool;
-        default = false;
+        type = types.nullOr types.bool;
+        default = null;
         description = ''
-          Whether PostgreSQL should listen on all network interfaces.
-          If disabled, the database can only be accessed via its Unix
-          domain socket or via TCP connections to localhost.
+          Whether PostgreSQL should listen on network interfaces.
+          If 'false', the database can only be accessed via its Unix
+          domain socket.
+          A value of 'null' defaults to 'true'.
+        '';
+      };
+
+      listenAddresses = mkOption {
+        type = types.str;
+        default = "localhost";
+        description = ''
+          The TCP/IP address(es) on which the server is to listen for connections from client applications.
+          The value takes the form of a comma-separated list of host names and/or numeric IP addresses.
+          The special entry `*` corresponds to all available IP interfaces.
+
+          See the PostgreSQL documentation on [listen_address](https://www.postgresql.org/docs/current/runtime-config-connection.html#GUC-LISTEN-ADDRESSES).
         '';
       };
 
@@ -472,12 +485,16 @@ in
       '';
     }) cfg.ensureUsers;
 
+    warnings = lib.optional (cfg.enableTCPIP == true) ''
+      Behaviour of `services.postgresql.enableTCPIP` changed from binding on all interfaces to binding on localhost in addition to the unix socket.
+    '';
+
     services.postgresql.settings =
       {
         hba_file = "${pkgs.writeText "pg_hba.conf" cfg.authentication}";
         ident_file = "${pkgs.writeText "pg_ident.conf" cfg.identMap}";
         log_destination = "stderr";
-        listen_addresses = if cfg.enableTCPIP then "*" else "localhost";
+        listen_addresses = if (cfg.enableTCPIP != false) then cfg.listenAddresses else "";
         jit = mkDefault (if cfg.enableJIT then "on" else "off");
       };
 

nixos/tests/all-tests.nix

@@ -803,6 +803,7 @@ in {
   apache_datasketches = handleTest ./apache_datasketches.nix {};
   postgresql = handleTest ./postgresql.nix {};
   postgresql-jit = handleTest ./postgresql-jit.nix {};
+  postgresql-listen-addresses = handleTest ./postgresql-listen-addresses.nix {};
   postgresql-wal-receiver = handleTest ./postgresql-wal-receiver.nix {};
   postgresql-tls-client-cert = handleTest ./postgresql-tls-client-cert.nix {};
   powerdns = handleTest ./powerdns.nix {};

nixos/tests/postgresql-listen-addresses.nix

@@ -0,0 +1,75 @@
+{ system ? builtins.currentSystem
+, config ? {}
+, pkgs ? import ../.. { inherit system config; }
+}:
+
+pkgs.testers.runNixOSTest {
+  name = "postgresql-listen-addresses";
+  # Test that PostgreSQL defaults to "localhost" when enableTCPIP = true.
+
+  nodes = {
+    default = { pkgs, lib, ... }: {
+      # Default behaviour of the service
+      services.postgresql = {
+        enable = true;
+      };
+      environment.systemPackages = with pkgs; [
+        lsof
+      ];
+    };
+    listenall = { pkgs, lib, ... }: {
+      services.postgresql = {
+        enable = true;
+        listenAddresses = "0.0.0.0";
+        enableTCPIP = true;
+        # settings.listen_addresses = "0.0.0.0";
+      };
+      environment.systemPackages = with pkgs; [
+        lsof
+      ];
+    };
+    unixonly = { pkgs, lib, ... }: {
+      services.postgresql = {
+        enable = true;
+        enableTCPIP = false;
+      };
+      environment.systemPackages = with pkgs; [
+        lsof
+      ];
+    };
+  };
+
+  testScript = ''
+    machines = [ default, listenall, unixonly ]
+
+    for machine in machines:
+        machine.start()
+        machine.wait_for_unit("postgresql.service")
+
+    with subtest("Configured to listen on localhost"):
+        default.succeed(
+            "sudo -u postgres psql <<<'SHOW listen_addresses' 2>/dev/null | grep 'localhost'")
+
+    with subtest("Actually listening on localhost"):
+        output = default.succeed("lsof -i tcp -P | grep 'localhost:5432'")
+
+    with subtest("Configured to listen on localhost"):
+        listenall.succeed(
+            "sudo -u postgres psql <<<'SHOW listen_addresses' 2>/dev/null | grep '0.0.0.0'")
+
+    with subtest("Actually listening on localhost"):
+        listenall.succeed("lsof -i tcp -P | grep '*:5432'")
+
+    with subtest("Configured not to listen on localhost or 0.0.0.0"):
+        unixonly.fail(
+            "sudo -u postgres psql <<<'SHOW listen_addresses' 2>/dev/null | grep 'localhost'")
+        unixonly.fail(
+            "sudo -u postgres psql <<<'SHOW listen_addresses' 2>/dev/null | grep '0.0.0.0'")
+
+    with subtest("Actually not listening on TCP"):
+        unixonly.fail("lsof -i tcp -P | grep ':5432'")
+
+    for machine in machines:
+        machine.shutdown()
+  '';
+}

pkgs/servers/sql/postgresql/generic.nix

@@ -271,6 +271,11 @@ let
           pkgs = self;
           package = this;
         };
+        postgresql-listen-addresses = import ../../../../nixos/tests/postgresql-listen-addresses.nix {
+          inherit (stdenv) system;
+          pkgs = self;
+          package = this;
+        };
         pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
       } // lib.optionalAttrs jitSupport {
         postgresql-jit = import ../../../../nixos/tests/postgresql-jit.nix {