# PostgreSQL configuration

Use this page to understand PostgreSQL connection fields for Ripple Custody. The example shows one possible external database configuration; hostnames, credentials, SSL certificates, connection limits, and database operations depend on your deployment.

This page applies to on-premise deployments only. For current defaults and the full supported schema, use the configuration packaged with your release.

For database planning, see [Database planning](/products/custody/v1.36/deployment/planning/database).

## What this config controls

Ripple Custody uses PostgreSQL as its primary data store. The `harmonize.postgresql` section supplies global connection values used by platform components.

Some release packages can also deploy an internal PostgreSQL instance for non-production or test-style environments. If you use an external database, set `postgresql.enabled: false`.

## Connection fields

Location: `harmonize.postgresql`

| Parameter | Type | Default | Description |
|  --- | --- | --- | --- |
| `host` | string | `""` | Database server host address. |
| `port` | string | `""` | Database server port. Common value: `5432`. |
| `database` | string | `"postgres"` | Default database name to connect to. |
| `username` | string | `""` | Database username. |
| `password` | string | `""` | Database password. |
| `maxConnections` | string | `"8"` | Maximum number of concurrent connections per component. |
| `urlParams` | string | `""` | Extra connection parameters for Java/JDBC containers. |
| `dotNetParams` | string | `""` | Extra connection parameters for .NET containers. |


## SSL/TLS fields

| Parameter | Type | Default | Description |
|  --- | --- | --- | --- |
| `sslmode` | string | `""` | SSL connection mode. See [SSL modes](#ssl-modes). |
| `sslrootcert` | string | `""` | File path containing SSL certificate authority certificates. |
| `sslcert` | string | `""` | File path of the client SSL certificate. |
| `sslkey` | string | `""` | File path for the secret key in PEM format. |
| `sslcertpfx` | string | `""` | File path for the secret key in PKCS#12 format. |
| `sslkeypkcs8` | string | `""` | File path for the secret key in PKCS#8 format. |


### SSL modes

| Mode | Description |
|  --- | --- |
| `disable` | Only try a non-SSL connection. |
| `allow` | First try a non-SSL connection; if that fails, try SSL. |
| `prefer` | First try SSL; if that fails, try a non-SSL connection. |
| `require` | Only try SSL. If a root CA file is present, verify the certificate. |
| `verify-ca` | Only try SSL and verify that the server certificate is issued by a trusted CA. |
| `verify-full` | Only try SSL, verify the CA, and verify that the server hostname matches the certificate. |


For PostgreSQL SSL behavior, see the PostgreSQL documentation for connection strings and SSL support.

## Database schemas

Ripple Custody uses separate PostgreSQL schemas for logical isolation between components. The database user specified in `harmonize.postgresql.username` needs permission to create or use the required schemas.

## Constraints and relationships

- Database credentials should come from your secret-management process.
- SSL certificate file paths must match files mounted into the relevant components.
- `urlParams` and `dotNetParams` let different runtime stacks receive equivalent database connection options.
- Component-specific database secrets are covered in [Secret management for authentication](/products/custody/v1.36/deployment/reference/auth-secrets).


## Example

This example shows an external PostgreSQL connection with SSL enabled:


```yaml
harmonize:
  postgresql:
    host: "postgres.example.com"
    port: "5432"
    database: "harmonize"
    username: "harmonize_user"
    password: "<database-password>"
    maxConnections: "20"
    sslmode: "require"
    urlParams: "ssl=true&sslmode=require"
    dotNetParams: "SSL Mode=Require"

postgresql:
  enabled: false
```

## Related topics

- [Database planning](/products/custody/v1.36/deployment/planning/database)
- [AMQP configuration](/products/custody/v1.36/deployment/reference/amqp)
- [Networking configuration](/products/custody/v1.36/deployment/reference/networking)
- [Secret management for authentication](/products/custody/v1.36/deployment/reference/auth-secrets)