pgconsole.example.toml

# pgconsole.toml - Database connections configuration
# Copy this file to pgconsole.toml and update with your connections

# =============================================================================
# General settings
# =============================================================================
# [general]
# external_url = "https://pgconsole.example.com"  # Required when OAuth providers are enabled
#
# # Banner (optional) - displays at the top of the page, cannot be dismissed
# [general.banner]
# text = "System maintenance scheduled for Sunday 2am UTC"
# link = "https://status.example.com"  # Optional - makes entire banner clickable (opens in new tab)
# color = "#7c3aed"  # Optional

# =============================================================================
# Audit log settings
# =============================================================================
# Audit entries are retained in memory for the /audit-log page. By default they
# are retained indefinitely until server restart. Set retention_days to prune
# entries older than the configured number of days.
#
# [general.audit]
# retention_days = 30

# =============================================================================
# Branding
# =============================================================================
# Replace the pgconsole logo with your own.
#
# [branding]
# logo = "https://example.com/your-logo.svg"
# logo_link = "https://internal.example.com"   # Optional - where the logo links to (default: /)

# =============================================================================
# AI providers for Text-to-SQL (optional)
# =============================================================================
# Supported vendors: openai, anthropic, google, openai-compatible
#
# [[ai.providers]]
# id = "gpt4"
# name = "GPT-4o"
# vendor = "openai"
# model = "gpt-4o"
# api_key = "sk-..."
#
# # openai-compatible: any provider implementing the OpenAI API
# # (Groq, OpenRouter, Together, Ollama, vLLM, LiteLLM, ...). base_url is required.
# [[ai.providers]]
# id = "groq"
# name = "Llama 3.3 70B"
# vendor = "openai-compatible"
# model = "llama-3.3-70b-versatile"
# api_key = "gsk_..."
# base_url = "https://api.groq.com/openai/v1"
#
# # api_key may be omitted for local providers that run without authentication
# [[ai.providers]]
# id = "ollama"
# name = "Ollama (local)"
# vendor = "openai-compatible"
# model = "llama3.3"
# base_url = "http://localhost:11434/v1"
#
# [[ai.providers]]
# id = "claude"
# name = "Claude Sonnet"
# vendor = "anthropic"
# model = "claude-sonnet-4-20250514"
# api_key = "sk-ant-..."
#
# [[ai.providers]]
# id = "gemini"
# name = "Gemini Pro"
# vendor = "google"
# model = "gemini-1.5-pro"
# api_key = "AIza..."

# =============================================================================
# Labels for organizing connections
# =============================================================================
[[labels]]
id = "dev"
name = "Development"
color = "#3b82f6"    # blue

[[labels]]
id = "staging"
name = "Staging"
color = "#f59e0b" # amber

[[labels]]
id = "prod"
name = "Production"
color = "#ef4444"   # red

[[labels]]
id = "critical"
name = "Critical"
color = "#dc2626" # dark red

# =============================================================================
# Connections
# =============================================================================

[[connections]]
id = "local"
name = "Local Development"
host = "localhost"
port = 5432
database = "postgres"
username = "postgres"
password = "postgres"
labels = ["dev"]

[[connections]]
id = "staging"
name = "Staging"
host = "staging.example.com"
port = 5432
database = "myapp"
username = "app_user"
password = "staging_password"
ssl_mode = "require"
labels = ["staging"]

# Example with full SSL configuration and timeouts
# [[connections]]
# id = "production"
# name = "Production"
# host = "prod.example.com"
# port = 5432
# database = "myapp"
# username = "app_user"
# password = "prod_password"
# ssl_mode = "verify-full"
# ssl_ca = "/path/to/ca.crt"
# ssl_cert = "/path/to/client.crt"
# ssl_key = "/path/to/client.key"
# labels = ["prod", "critical"]
# lock_timeout = "5s"        # Optional - abort if lock not acquired within duration
# statement_timeout = "30s"  # Optional - abort queries exceeding duration
# lazy = true                # Optional - skip connection test on startup

# =============================================================================
# Authentication (optional - if omitted, no authentication is required)
# =============================================================================

# [auth]
# jwt_secret = "your-secret-key-at-least-32-characters-long"    # openssl rand -hex 32
# signin_expiry = "7d"  # session duration: h=hours, d=days, w=weeks (default: 7d)
#
# # OAuth providers (optional)
# [[auth.providers]]
# type = "google"
# client_id = "your-google-client-id.apps.googleusercontent.com"
# client_secret = "your-google-client-secret"
#
# [[auth.providers]]
# type = "keycloak"
# issuer_url = "https://keycloak.example.com/realms/myrealm"
# client_id = "pgconsole"
# client_secret = "your-keycloak-client-secret"
#
# [[auth.providers]]
# type = "okta"
# issuer_url = "https://your-org.okta.com/oauth2/default"
# client_id = "your-okta-client-id"
# client_secret = "your-okta-client-secret"
#
# =============================================================================
# Users (required when auth is enabled)
# =============================================================================
# Each user needs an email. Password present = basic auth login.
# No password = SSO-only (must match an OAuth provider login).
#
# [[users]]
# email = "admin@example.com"
# password = "admin123"
#
# [[users]]
# email = "developer@example.com"
# password = "dev456"
#
# [[users]]
# email = "alice@example.com"   # SSO-only user (no password)
# 
# User groups (optional)
# Members are user emails
# [[groups]]
# id = "dev-team"
# name = "Development Team"
# members = ["developer@example.com", "alice@example.com"]
#
# [[groups]]
# id = "dba"
# name = "Database Administrators"
# members = ["admin@example.com"]

# =============================================================================
# Agents (optional) - non-human principals for the MCP server
# =============================================================================
# Each agent authenticates to the MCP endpoint (/mcp) with a bearer token:
#   Authorization: Bearer <token>
# An agent is one of two kinds:
#
# 1. Pure agent (no on_behalf_of) - a standalone service account.
#    Authorized by [[iam]] rules whose members include "agent:<id>".
#    Do NOT set permissions/connections here; grant access via [[iam]] instead.
#
# 2. Delegated agent (on_behalf_of set) - acts for a user, inheriting that
#    user's permissions. The optional permissions/connections fields are caps
#    that further narrow (intersect with) the user's grant.
#
# Fields: id (required), token (required), name (optional, defaults to id),
#   on_behalf_of (user email), permissions (delegated only), connections (delegated only)
#
# # Pure agent - authorize it with an [[iam]] rule using member "agent:<id>" (see below)
# [[agents]]
# id = "ci-bot"
# name = "CI Pipeline"
# token = "generate-a-long-random-secret"   # openssl rand -hex 32
#
# # Delegated agent - acts as alice, capped to read-only on the local connection
# [[agents]]
# id = "alice-assistant"
# name = "Alice's Assistant"
# token = "another-long-random-secret"
# on_behalf_of = "alice@example.com"   # must match a [[users]] email
# permissions = ["read"]               # cap: intersected with alice's IAM grant
# connections = ["local"]              # cap: connection IDs the agent may touch

# =============================================================================
# IAM Rules (optional - requires auth to be enabled)
# =============================================================================
# Controls what users can do on each connection
# Permissions: read (SELECT), write (INSERT/UPDATE/DELETE), ddl (CREATE/ALTER/DROP),
#   admin (full access), explain (EXPLAIN), execute (CALL), export (CSV export)
#   Use "*" to grant all permissions at once
# Members: "user:<email>", "group:<id>", "agent:<id>", or "*" (all human users; a pure
#   agent matches only explicit "agent:<id>" rules, never "*"/"user:"/"group:",
#   while a delegated agent inherits its user's matches)
# Connection: specific connection id or "*" for all connections
# Multiple matching rules are unioned (user gets all permissions from all matching rules)
# Default deny: no matching rule = no access (connection hidden from user)
#
# [[iam]]
# connection = "*"
# permissions = ["read"]
# members = ["*"]
#
# [[iam]]
# connection = "local"
# permissions = ["*"]
# members = ["user:admin@example.com", "group:dba"]
#
# [[iam]]
# connection = "staging"
# permissions = ["read", "write"]
# members = ["group:dev-team"]
#
# # Authorize a pure agent (see the Agents section above)
# [[iam]]
# connection = "staging"
# permissions = ["read", "ddl"]
# members = ["agent:ci-bot"]