salt% cat files/auth_query.sh
psql ${PSQL_ARGS} <<EOF
CREATE OR REPLACE FUNCTION pgbouncer.user_lookup(in i_username text, out uname text, out phash text)
RETURNS record AS \$\$
BEGIN
    SELECT usename, passwd FROM pg_catalog.pg_shadow
    WHERE usename = i_username INTO uname, phash;
    RETURN;
END;
\$\$ LANGUAGE plpgsql SECURITY DEFINER;
REVOKE ALL ON FUNCTION pgbouncer.user_lookup(text) FROM public, pgbouncer;
GRANT EXECUTE ON FUNCTION pgbouncer.user_lookup(text) TO pgbouncer;
EOF

salt% cat chouffe.sls
#!yaml|gpg

pgbouncer:
  config:
    pgbouncer:
      auth_user: pgbouncer
      auth_query: SELECT * FROM pgbouncer.user_lookup($1)
      admin_users: admin
      log_connections: 0
      log_disconnections: 0
      log_pooler_errors: 1
      verbose: 0
      server_lifetime: 1800
    databases:
      '*': host=db.prod.lan auth_user=pgbouncer
      afromoths: auth_user=pgbouncer pool_mode=transaction