Before anyone can reasonably answer this (and maybe dba.stackexchange.com would be a better place to ask) can you 100% confirm that the issue can't come from yo

Before anyone can reasonably answer this (and maybe dba.stackexchange.com would be a better place to ask) can you 100% confirm that the issue can't come from your ssh setup? > I remember disabling password based login, and just authenticating over SSH, and my server still got compromised after a day or two. This sentence in particular is hard to parse. Did you turn off password login in pg_hba.conf or in your sshd_config ? PS: VPS box literally start being scanned/tested over standard ssh port minutes after being spin-up. It seem less frequent however to be attacked for specific postgreSQL vulnerabilities (but that might well be a new trend).