PostgreSQL connector

Configure database settings, SSL and password or SSH-tunnel authentication for PostgreSQL connections.

PostgreSQL is enabled for saved source and destination connections. Use postgres for both connector_id and connector_type; its connector category is databases.

Database settings

Field	Requirement
`host`	Non-empty hostname or reachable database address.
`port`	Integer from `1` to `65535`; defaults to `5432`.
`database`	Non-empty database name.
`username`	Non-empty database username.
`ssl_mode`	`disable`, `require`, `verify-ca` or `verify-full`; defaults to `disable`.

Authentication

Choose exactly one authentication branch: password_auth or ssh_tunnel_auth. Store credentials in a Secret Vault and select references containing namespace and key.

Password authentication

Use password_auth.password_ref to reference the database password. This example is the connection configuration object:

{
  "host": "db.example.internal",
  "port": 5432,
  "database": "analytics",
  "username": "data_reader",
  "ssl_mode": "verify-full",
  "password_auth": {
    "password_ref": {
      "namespace": "production-data",
      "key": "postgres-password"
    }
  }
}

SSH-tunnel authentication

Use an SSH tunnel when the database is reachable through a bastion. The tunnel branch still requires a password_ref for the PostgreSQL password.

Field	Requirement
`ssh_host`	Required bastion hostname or address.
`ssh_port`	Integer from `1` to `65535`; defaults to `22`.
`ssh_user`	Required SSH username.
`ssh_host_fingerprint`	Required, verified SSH host fingerprint.
`ssh_password_ref` or `ssh_private_key_ref`	Exactly one SSH credential reference.
`ssh_private_key_passphrase_ref`	Optional passphrase reference for an encrypted private key.

{
  "host": "db.private.internal",
  "port": 5432,
  "database": "analytics",
  "username": "data_reader",
  "ssl_mode": "require",
  "ssh_tunnel_auth": {
    "password_ref": {
      "namespace": "production-data",
      "key": "postgres-password"
    },
    "ssh_host": "bastion.example.internal",
    "ssh_port": 22,
    "ssh_user": "connector",
    "ssh_host_fingerprint": "SHA256:replace-with-verified-fingerprint",
    "ssh_private_key_ref": {
      "namespace": "production-data",
      "key": "ssh-private-key"
    }
  }
}

Verify the bastion identity

Obtain the host fingerprint through a trusted channel before saving it. Investigate a mismatch instead of replacing the fingerprint with one from a failed, unauthenticated connection.

SSL modes

Mode	Behavior
`disable`	Does not require TLS; use only with an explicitly trusted network and database configuration.
`require`	Encrypts the connection without full certificate identity verification.
`verify-ca`	Requires a certificate chain trusted by the runtime.
`verify-full`	Also verifies that the server identity matches the requested host.

Choose the strongest mode supported by the database deployment. The default is disable, so set the intended mode explicitly.

Validate and save

Create the database and any SSH secret references.
Open VegaFlow → Connections → New connection and choose PostgreSQL.
Enter database settings and select one authentication branch.
Validate connectivity, authentication and the required source or destination privileges.
Save and grant the QuickFlow operator permission to use the connection.

Revalidate after changes to credentials, database settings or network access. Use catalog discovery to select streams and supported sync modes for a flow.

Troubleshooting

Failure	Check
Configuration rejected	Required fields, port range, SSL mode, exactly one authentication branch and exactly one SSH credential type.
Network unavailable	DNS, routing, firewall, database listener and bastion reachability.
Authentication failed	Database username/password, SSH identity and secret permissions.
Certificate rejected	Runtime CA trust, requested hostname and SSL mode.
Host fingerprint mismatch	Verify the bastion identity through a trusted channel before changing configuration.