PostgreSQL

This guide covers connecting self-hosted PostgreSQL to Airlock via Database Service with mutual TLS authentication.

Prerequisites

• A PostgreSQL instance in your infrastructure.
• The psql client in PATH on the user’s workstation.
• A host for Database Service (Linux or Kubernetes).
• Access to airctl on the administrator’s machine.

Step 1. Join token and Airlock user

airctl tokens add --type=db --format=text > /tmp/token

airctl users add --roles=access,db alice

Step 2. Certificates for mTLS

Database Service connects to PostgreSQL over TLS. Generate a certificate for the host from which the agent reaches PostgreSQL:

airctl auth sign --format=db --host=db.example.com --out=server --ttl=2190h

This creates the files server.cas, server.crt, server.key — place them on the PostgreSQL server.

Step 3. Configure PostgreSQL

In postgresql.conf:

ssl = on
ssl_cert_file = '/path/to/server.crt'
ssl_key_file = '/path/to/server.key'
ssl_ca_file = '/path/to/server.cas'

In pg_hba.conf, add client certificate authentication:

hostssl all             all             ::/0                    cert
hostssl all             all             0.0.0.0/0               cert

Make sure there are no md5 rules with higher priority for the same connections — otherwise Airlock cannot authenticate by certificate.

Restart PostgreSQL.

Step 4. Database Service

Linux

curl https://deckhouse.ru/downloads/airlock/install.sh | bash -s

sudo airlock db configure create \
  --token=/tmp/token \
  --name=example-postgres \
  --proxy=airlock.example.com:443 \
  --protocol=postgres \
  --uri=postgres.example.com:5432 \
  --output file:///etc/airlock.yaml

sudo systemctl enable --now airlock

Kubernetes

Install the airlock-kube-agent chart with the db role and database parameters (see Kubernetes agent for adding the Helm repository).

Step 5. Connect

airsh login --proxy=airlock.example.com --user=alice
airsh db ls
airsh db connect --db-user=postgres --db-name=postgres example-postgres

End the session:

airsh db logout example-postgres

The list of accessible databases depends on the RBAC role — see Database access policies.