diff --git a/patroni/postgresql.py b/patroni/postgresql.py
index cf2fddfa..0174ee88 100644
--- a/patroni/postgresql.py
+++ b/patroni/postgresql.py
@@ -447,11 +447,7 @@ class Postgresql(object):
 
     def write_pg_hba(self):
         with open(os.path.join(self.data_dir, 'pg_hba.conf'), 'a') as f:
-            f.write('\nhost replication {username} {network} md5\n'.format(**self.replication))
-            for line in self.config.get('pg_hba', []):
-                if line.split()[0].strip() == 'hostssl' and self.server_parameters.get('ssl', 'off').lower() != 'on':
-                    continue
-                f.write(line + '\n')
+            f.write('\n{}\n'.format('\n'.join(self.config.get('pg_hba', []))))
 
     @staticmethod
     def primary_conninfo(leader_url):
diff --git a/postgres0.yml b/postgres0.yml
index c02429b4..0bbdd34e 100644
--- a/postgres0.yml
+++ b/postgres0.yml
@@ -56,12 +56,12 @@ postgresql:
     username: postgres
     password: zalando
   pg_hba:
+  - host replication replicator 127.0.0.1/32 md5
   - host all all 0.0.0.0/0 md5
-  - hostssl all all 0.0.0.0/0 md5
+  # - hostssl all all 0.0.0.0/0 md5
   replication:
     username: replicator
     password: rep-pass
-    network:  127.0.0.1/32
   superuser:
     username: postgres
     password: zalando
diff --git a/postgres1.yml b/postgres1.yml
index 1b3ef72a..85529b36 100644
--- a/postgres1.yml
+++ b/postgres1.yml
@@ -56,12 +56,12 @@ postgresql:
     username: postgres
     password: zalando
   pg_hba:
+  - host replication replicator 127.0.0.1/32 md5
   - host all all 0.0.0.0/0 md5
-  - hostssl all all 0.0.0.0/0 md5
+  # - hostssl all all 0.0.0.0/0 md5
   replication:
     username: replicator
     password: rep-pass
-    network: 127.0.0.1/32
   superuser:
     username: postgres
     password: zalando
diff --git a/postgres2.yml b/postgres2.yml
index db0d7c61..be0615ce 100644
--- a/postgres2.yml
+++ b/postgres2.yml
@@ -56,12 +56,12 @@ postgresql:
     username: postgres
     password: zalando
   pg_hba:
+  - host replication replicator 127.0.0.1/32 md5
   - host all all 0.0.0.0/0 md5
-  - hostssl all all 0.0.0.0/0 md5
+  # - hostssl all all 0.0.0.0/0 md5
   replication:
     username: replicator
     password: rep-pass
-    network: 127.0.0.1/32
   superuser:
     username: postgres
     password: zalando
diff --git a/tests/test_postgresql.py b/tests/test_postgresql.py
index 932e860d..51ba70b4 100644
--- a/tests/test_postgresql.py
+++ b/tests/test_postgresql.py
@@ -164,13 +164,14 @@ class TestPostgresql(unittest.TestCase):
     def setUp(self):
         self.p = Postgresql({'name': 'test0', 'scope': 'batman', 'data_dir': 'data/test0',
                              'listen': '127.0.0.1, *:5432', 'connect_address': '127.0.0.2:5432',
-                             'pg_hba': ['hostssl all all 0.0.0.0/0 md5', 'host all all 0.0.0.0/0 md5'],
+                             'pg_hba': ['host replication replicator 127.0.0.1/32 md5',
+                                        'hostssl all all 0.0.0.0/0 md5',
+                                        'host all all 0.0.0.0/0 md5'],
                              'superuser': {'username': 'test', 'password': 'test'},
                              'admin': {'username': 'admin', 'password': 'admin'},
                              'pg_rewind': {'username': 'admin', 'password': 'admin'},
                              'replication': {'username': 'replicator',
-                                             'password': 'rep-pass',
-                                             'network': '127.0.0.1/32'},
+                                             'password': 'rep-pass'},
                              'parameters': {'foo': 'bar'}, 'recovery_conf': {'foo': 'bar'},
                              'callbacks': {'on_start': 'true', 'on_stop': 'true',
                                            'on_restart': 'true', 'on_role_change': 'true',
@@ -205,6 +206,11 @@ class TestPostgresql(unittest.TestCase):
         self.assertTrue(self.p.initialize())
         self.assertTrue(os.path.exists(os.path.join(self.p.data_dir, 'pg_hba.conf')))
 
+        with open(os.path.join(self.p.data_dir, 'pg_hba.conf')) as f:
+            lines = f.readlines()
+            assert 'host replication replicator 127.0.0.1/32 md5\n' in lines
+            assert 'host all all 0.0.0.0/0 md5\n' in lines
+
     @patch('os.path.exists', Mock(return_value=True))
     @patch('os.unlink', Mock())
     def test_delete_trigger_file(self):