I'm removing that line, this will be done as part of the Mastodon, ejabberd, gitea cookbooks. They wouldn't use a different port, but clients still need access for the specific database, user and IP (https://www.postgresql.org/docs/12/auth-pg-hba-conf.html)
I forgot to remove that part from the README, as we said in #160 that we don't care about verifying the root cert. It would be done in the cookbooks for software that connects to PostgreSQL (together with creating databases) and not in this cookbook
If we only want to encrypt the traffic and do not care about the root cert's validity then there's no need to create an issue for ejabberd, or to wait for a verify-ca feature.
I think the PR is good to go, since right now Mastodon and ejabberd connect to PostgreSQL using localhost, so the ejabberd cookbook will only need to be updated to create a cluster with the new server