Setting up production postgres (createdb permissions) - postgresql

Question

I'm setting up postgres on DigitalOcean. I've set PG envs. The 9s are obviously redacted data. To facilitate the ssl connection, ~/.postgresql/root.crt exists.
# env | grep PG
PGPORT=99999
PGPASSWORD=9999999999999
PGSSLMODE=require
PGUSER=doadmin
PGDATABASE=auth_service_prod
PGHOST=private-db-postgresql-sfo9-99999-do-user-9999999-9.a.db.ondigitalocean.com
When calling createdb, it fails:
# createdb
createdb: could not connect to database template1: FATAL: pg_hba.conf rejects connection for host "10.999.9.99", user "doadmin", database "template1", SSL on
I can connect to psql, though. I don't know enough about configuring postgres to allow doadmin to create a db, but hopefully here is some useful info:
# psql
psql (11.7 (Debian 11.7-0+deb10u1), server 11.8)
SSL connection (protocol: TLSv1.3, cipher: TLS_AES_256_GCM_SHA384, bits: 256, compression: off)
Type "help" for help.
auth_service_prod=> \du
List of roles
Role name | Attributes | Member of
-----------+------------------------------------------------------------+-----------
_dodb | Superuser, Replication | {}
doadmin | Create role, Create DB, Replication, Bypass RLS | {}
postgres | Superuser, Create role, Create DB, Replication, Bypass RLS | {}
auth_service_prod=> \l
List of databases
Name | Owner | Encoding | Collate | Ctype | Access privileges
-------------------+----------+----------+-------------+-------------+-----------------------
_dodb | postgres | UTF8 | en_US.UTF-8 | en_US.UTF-8 |
auth_service_prod | doadmin | UTF8 | en_US.UTF-8 | en_US.UTF-8 |
defaultdb | doadmin | UTF8 | en_US.UTF-8 | en_US.UTF-8 |
template0 | postgres | UTF8 | en_US.UTF-8 | en_US.UTF-8 | =c/postgres +
| | | | | postgres=CTc/postgres
template1 | postgres | UTF8 | en_US.UTF-8 | en_US.UTF-8 | =c/postgres +
| | | | | postgres=CTc/postgres
(5 rows)

Answer 1

DigitalOcean doesn't allow createdb from postgres, apparently. I removed the code creating databases, and created them "manually" from their GUI. The app is now only responsible for managing the schema, not the database(s).