This is an experimental
encrypted access method for PostgreSQL 16.
To download the latest build of the main branch, use the HEAD
release from releases.
Builds are available in a tar.gz format, containing only the required files, and as a deb package. The deb package is built against the pgdg16 release, but this dependency is not yet enforced in the package.
Find more information about pg_tde
in the documentation.
- Build and install the plugin with make from source, or download a release and install the package
pg_tde
needs to be loaded at the start time. The extension requires additional shared memory; therefore, add thepg_tde
value for theshared_preload_libraries
parameter and restart thepostgresql
instance.
Use the ALTER SYSTEM command from psql
terminal to modify the shared_preload_libraries
parameter.
ALTER SYSTEM SET shared_preload_libraries = 'pg_tde';
- Start or restart the
postgresql
instance to apply the changes.
- On Debian and Ubuntu:
sudo systemctl restart postgresql.service
- Create the extension using the CREATE EXTENSION command. Using this command requires the privileges of a superuser or a database owner. Connect to
psql
as a superuser for a database and run the following command:
CREATE EXTENSION pg_tde;
- Set the location of the keyring configuration file in postgresql.conf:
pg_tde.keyringConfigFile = '/where/to/put/the/keyring.json'
- Create the keyring configuration file (see example keyring configuration)
- Start or restart the
postgresql
instance to apply the changes.
- On Debian and Ubuntu:
sudo systemctl restart postgresql.service
{
"provider": "file",
"datafile": "/tmp/pgkeyring"
}
Currently the keyring configuration only supports the file provider, with a single datafile parameter. This datafile is created and managed by Postgres, the only requirement is that postgres should be able to write to the specified path.
This setup is intended for developmenet, and stores the keys unencrypted in the specified data file.
- To build
pg_tde
from source code, you require the following:
- On Debian and Ubuntu:
sudo apt install make gcc autoconf libjson-c-dev libcurl4-openssl-dev postgresql-server-dev-16
- On MacOS:
brew install make autoconf curl json-c gettext postresql@16
-
Install or build postgresql 16 (see reference commit below)
-
If postgres is installed in a non standard directory, set the
PG_CONFIG
environment variable to point to thepg_config
executable -
Clone the repository, build and install it with the following commands:
git clone git://github.com/Percona-Lab/postgres-tde-ext
Compile and install the extension
cd postgres-tde-ext
./configure
make USE_PGXS=1
sudo make USE_PGXS=1 install
See Make Builds for Developers for more info on the build infrastructure.
- Download the latest release package
wget https://github.com/Percona-Lab/postgres-tde-ext/releases/download/latest/pgtde-pgdg16.deb
- Install the package
sudo dpkg -i pgtde-pgdg16.deb
You can find docker images built from the current main branch on Docker Hub. Images build on top of postgres:16 official image. To run it:
docker run --name pg-tde -e POSTGRES_PASSWORD=mysecretpassword -d perconalab/postgres-tde-ext
It builds and adds pg_tde
extension to Postgres 16. Relevant postgresql.conf
and tde_conf.json
are created in /etc/postgresql/
inside the container. This dir is exposed as volume.
See https://hub.docker.com/_/postgres on usage.
You can also build a docker image manually with:
docker build . -f ./docker/Dockerfile -t your-image-name
The extension provides the following helper functions:
Returns t
if the table is encrypted (uses the pg_tde access method), or f
otherwise.
This is based on the heap code as of the following commit:
commit a81e5516fa4bc53e332cb35eefe231147c0e1749 (HEAD -> REL_16_STABLE, origin/REL_16_STABLE)
Author: Amit Kapila <akapila@postgresql.org>
Date: Wed Sep 13 09:48:31 2023 +0530
Fix the ALTER SUBSCRIPTION to reflect the change in run_as_owner option.