Skip to main content
This guide explains how to connect Coalesce Quality to Postgres securely.We need this information so we can collect metadata about your tables.To be able to finish this guide, you’ll need the following:
→ Access to modify your Postgres configuration⏱️ Estimated time to finish: 10 minutes.
Coalesce Quality reads the catalog of your database from pg_catalog: schemas, tables, views, materialized views, columns, comments, constraints and view definitions, and each table’s row count and size from the planner’s statistics. It never reads table rows to build the catalog. The following setup:
  1. Creates a dedicated user and user group for Coalesce Quality
  2. Grants access to the schemas you want to monitor
  3. Optionally grants SELECT, for monitors that query your data

​
Create a dedicated user with sufficient permissions

​
Grant access to the relevant schemas

Run this for every schema you want Coalesce Quality to monitor. It is all the catalog, the table metrics and the volume and freshness monitors need.

​
Grant access to table data (optional)

Required if you want Coalesce Quality to read rows: Custom SQL monitors, data previews, column profiling and SQL tests.
Run these for every schema you want those monitors on.
ALTER DEFAULT PRIVILEGES only affects tables created by the role you name in FOR ROLE. Set "table_owner" to the role that actually creates your tables (usually your application or migration user) — otherwise synq_group will not get SELECT on tables added in the future, and newly created tables will silently stop being monitored. If several roles create tables in the schema, repeat the statement once per owner.

​
Network Configuration

Depending on your database configurations, you may need to whitelist Coalesce Quality’s IP addresses in your firewall or security groups. See IP Whitelist for the complete list of IP addresses by region.

​
Input data in the UI

​
Integration name

E.g., postgres

​
Database

The name of your Postgres database

​
Host

The name of your host, e.g., database-1.<host>.eu-north-1.rds.amazonaws.com

​
Port

The default is 5432

​
Username and password

Username and password you specified earlier in the guide

​
SSH tunnel (optional)

If your Postgres instance is only reachable through a bastion host, click Add SSH tunnel and fill in the user, hostname and port of the bastion (22 unless you run SSH elsewhere). Leave this empty for instances Coalesce Quality can reach directly. Coalesce Quality authenticates to the bastion with an RSA key pair it generates when you save the integration. Only the public half leaves the platform; it is shown under SSH tunnel key pair at the bottom of the integration’s page. Add it as a line in the ~/.ssh/authorized_keys file of the bastion user you entered. The bastion refuses the connection until that line is in place, so testing the connection before then fails.

​
Rotating the tunnel key pair

The same SSH tunnel key pair section replaces the key. This needs the Admin role. Generate a new key pair takes effect immediately, and the key it replaces keeps being offered for a week, so the tunnel carries on working while you install the new one. The section shows the previous public key and the date it stops being offered. Add the new public key to authorized_keys, then delete the line holding the previous one. Removing that line is what revokes the old key — Coalesce Quality has no access to your bastion, so a key left in the file stays usable after the week is over. Only the most recent replacement is kept, so generating a second key pair while a previous key is still being offered retires that one straight away. Finish installing one key before generating the next.