PostgreSQL configuration

Use this page to understand PostgreSQL connection fields for Ripple Custody. The example shows one possible external database configuration; hostnames, credentials, SSL certificates, connection limits, and database operations depend on your deployment.

This page applies to on-premise deployments only. For current defaults and the full supported schema, use the configuration packaged with your release.

For database planning, see Database planning.

What this config controls

Ripple Custody uses PostgreSQL as its primary data store. The harmonize.postgresql section supplies global connection values used by platform components.

Some release packages can also deploy an internal PostgreSQL instance for non-production or test-style environments. If you use an external database, set postgresql.enabled: false.

Connection fields

Location: harmonize.postgresql

Parameter	Type	Default	Description
`host`	string	`""`	Database server host address.
`port`	string	`""`	Database server port. Common value: `5432`.
`database`	string	`"postgres"`	Default database name to connect to.
`username`	string	`""`	Database username.
`password`	string	`""`	Database password.
`maxConnections`	string	`"8"`	Maximum number of concurrent connections per component.
`urlParams`	string	`""`	Extra connection parameters for Java/JDBC containers.
`dotNetParams`	string	`""`	Extra connection parameters for .NET containers.

SSL/TLS fields

Parameter	Type	Default	Description
`sslmode`	string	`""`	SSL connection mode. See SSL modes.
`sslrootcert`	string	`""`	File path containing SSL certificate authority certificates.
`sslcert`	string	`""`	File path of the client SSL certificate.
`sslkey`	string	`""`	File path for the secret key in PEM format.
`sslcertpfx`	string	`""`	File path for the secret key in PKCS#12 format.
`sslkeypkcs8`	string	`""`	File path for the secret key in PKCS#8 format.

SSL modes

Mode	Description
`disable`	Only try a non-SSL connection.
`allow`	First try a non-SSL connection; if that fails, try SSL.
`prefer`	First try SSL; if that fails, try a non-SSL connection.
`require`	Only try SSL. If a root CA file is present, verify the certificate.
`verify-ca`	Only try SSL and verify that the server certificate is issued by a trusted CA.
`verify-full`	Only try SSL, verify the CA, and verify that the server hostname matches the certificate.

For PostgreSQL SSL behavior, see the PostgreSQL documentation for connection strings and SSL support.

Database schemas

Ripple Custody uses separate PostgreSQL schemas for logical isolation between components. The database user specified in harmonize.postgresql.username needs permission to create or use the required schemas.

Constraints and relationships

Database credentials should come from your secret-management process.
SSL certificate file paths must match files mounted into the relevant components.
urlParams and dotNetParams let different runtime stacks receive equivalent database connection options.
Component-specific database secrets are covered in Secret management for authentication.

Example

This example shows an external PostgreSQL connection with SSL enabled:

harmonize:
  postgresql:
    host: "postgres.example.com"
    port: "5432"
    database: "harmonize"
    username: "harmonize_user"
    password: "<database-password>"
    maxConnections: "20"
    sslmode: "require"
    urlParams: "ssl=true&sslmode=require"
    dotNetParams: "SSL Mode=Require"

postgresql:
  enabled: false