I tend to use the following in pg_hba.conf:
# Database administrative login by UNIX sockets
local all postgres ident
# TYPE DATABASE USER CIDR-ADDRESS METHOD
local all all md5
host all all 127.0.0.1/32 md5
host all all ::1/128 md5
That means that once you're "postgres", you don't need a password, but you need sudo rights to become postgres, so that's pretty darn secure. Any other user can login using simple md5 authentication, which means you don't have to sudo all over the place. This works well for me.