IBM Cloud Databases: PostgreSQL on IBM Cloud

Introduction

To deploy the GitGuardian app, a PostgreSQL instance is required. This page is dedicated to helping you set up PostgreSQL on IBM Cloud using IBM Cloud Databases for PostgreSQL.

High-Availability

IBM Cloud Databases for PostgreSQL deploys two members in a primary and replica configuration with automatic failover. The application connects to a single endpoint; failover may cause a short interruption.

Installation

From the IBM Cloud console

To create a PostgreSQL instance from the IBM Cloud console, we recommend following the official documentation.

You need to set the following fields:

• Set the Version to a supported PostgreSQL version. We recommend PostgreSQL 17.
• Set the Service endpoints to Private. The GitGuardian cluster reaches the database over the IBM Cloud private network.
• Allocate at least 4 GB of RAM per member. Connection capacity depends on it, see Connections below.
• Set the admin password after provisioning. You must save this value to create the application user.

Using the CLI

ibmcloud resource service-instance-create <instance-name> databases-for-postgresql standard <region> \
  --service-endpoints private \
  -p '{"version":"17","members_host_flavor":"multitenant","members_memory_allocation_mb":"8192","members_disk_allocation_mb":"20480"}'

Memory and disk values are totals shared by the two members.

Using Terraform

To create a PostgreSQL instance using Terraform, you need the following resource:

• ibm_database

In addition to the fields required by Terraform, we require the following fields to be set:

• service = "databases-for-postgresql"
• version = "17": a supported PostgreSQL version.
• service_endpoints = "private": keep the database off the public internet.

Database and user

IBM Cloud's admin user is not a superuser and cannot transfer ownership of a database to another user. Create the application user with the CLI, then connect as that user to create the database:

ibmcloud cdb deployment-user-create <instance-name> gim <password>

-- connected as gim
CREATE DATABASE prm;

The database is owned by IBM Cloud's ibm-cloud-base-user group role, of which gim is a member, which grants the permissions GitGuardian needs.

The pg_trgm, btree_gin and pgvector extensions GitGuardian requires are available on IBM Cloud Databases for PostgreSQL 15 and later. GitGuardian creates them during the installation.

Connections

The default max_connections is 115, of which 100 are usable. Raise it before the first installation. IBM Cloud requires at least 2 GB of RAM per member for 215 connections:

ibmcloud cdb deployment-configuration <instance-name> '{"configuration":{"max_connections":215}}'

TLS

TLS is mandatory on IBM Cloud Databases. The CA certificate is embedded in the connection details:

ibmcloud cdb deployment-connections <instance-name> --user gim --endpoint-type private --output json

Decode the connection.postgres.certificate.certificate_base64 value and pass it as the PostgreSQL CA, then set the TLS mode to verify-full. See Configure TLS.

postgresql:
  host: '<instance-id>.<deployment-id>.private.databases.appdomain.cloud'
  port: <port>
  username: 'gim'
  database: 'prm'
  existingSecret: 'gitguardian-postgresql-secret'
  existingSecretKeys:
    password: 'POSTGRES_PASSWORD'
  tls:
    mode: 'verify-full'
    existingSecret: 'gitguardian-postgresql-tls-secret'
    existingSecretKeys:
      caCrt: 'ca.crt'