diff --git a/governor.py b/governor.py
index a6717faf..7492b0e5 100755
--- a/governor.py
+++ b/governor.py
@@ -53,6 +53,7 @@ if postgresql.data_directory_empty():
         etcd.take_leader(postgresql.name)
         postgresql.start()
         postgresql.create_replication_user()
+        postgresql.create_connection_users()
     else:
         synced_from_leader = False
         while not synced_from_leader:
diff --git a/helpers/postgresql.py b/helpers/postgresql.py
index ecc81b02..3fdd1515 100644
--- a/helpers/postgresql.py
+++ b/helpers/postgresql.py
@@ -14,6 +14,8 @@ class Postgresql:
         self.host, self.port = config["listen"].split(":")
         self.data_dir = config["data_dir"]
         self.replication = config["replication"]
+        self.superuser = config.get('superuser')
+        self.admin_user = config.get('admin')
 
         self.config = config
 
@@ -148,7 +150,9 @@ class Postgresql:
         f.write("host replication %(username)s %(network)s md5" %
                 {"username": self.replication["username"], "network": self.replication["network"]})
         # allow TCP connections from the host's own address
-        f.write("\nhost postgres postgres samehost trust\n" % {"network": self.host})
+        f.write("\nhost postgres postgres samehost trust\n")
+        # allow TCP connections from the rest of the world with a password
+        f.write("\nhost postgres postgres 0.0.0.0/0 md5\n")
         f.close()
 
     def write_recovery_conf(self, leader_hash):
@@ -183,5 +187,14 @@ recovery_target_timeline = 'latest'
     def create_replication_user(self):
         self.query("CREATE USER \"%s\" WITH REPLICATION ENCRYPTED PASSWORD '%s';" % (self.replication["username"], self.replication["password"]))
 
+    def create_connection_users(self):
+        if self.superuser:
+            if 'username' in self.superuser:
+                self.query("CREATE ROLE \"%s\" LOGIN SUPERUSER WITH PASSWORD '%s';".format(self.superuser["username"], self.superuser["password"]))
+            else:
+                self.query("ALTER ROLE postgres WITH PASSWORD '{0}'".format(self.superuser['password']))
+        if self.admin:
+            self.query("CREATE ROLE \"%s\" LOGIN CREATEDB CREATEROLE WITH PASSWORD '%s';".format(self.admin["username"], self.admin["password"]))
+
     def xlog_position(self):
         return self.query("SELECT pg_last_xlog_replay_location();").fetchone()[0]
diff --git a/postgres0.yml b/postgres0.yml
index 66d0b9eb..e7d05c5a 100644
--- a/postgres0.yml
+++ b/postgres0.yml
@@ -12,6 +12,11 @@ postgresql:
     username: replicator
     password: rep-pass
     network:  127.0.0.1/32
+  superuser:
+    password: zalando
+  admin:
+    username: admin
+    password: admin
   #recovery_conf:
     #restore_command: cp ../wal_archive/%f %p
   parameters:
diff --git a/postgres1.yml b/postgres1.yml
index 1332291b..f18ebd17 100644
--- a/postgres1.yml
+++ b/postgres1.yml
@@ -12,6 +12,11 @@ postgresql:
     username: replicator
     password: rep-pass
     network: 127.0.0.1/32
+  superuser:
+    password: zalando
+  admin:
+    username: admin
+    password: admin
   #recovery_conf:
     #restore_command: cp ../wal_archive/%f %p
   parameters: