Docs

Daita agents / guide

PostgreSQL

Attach selected PostgreSQL schemas with an explicit secret reference and execute bounded read-only queries.

#Credentials

Use a read-only database role and an explicit secret reference:

python
from daita.security import SecretReference
 
credential = SecretReference.environment("DAITA_POSTGRES_PASSWORD")

The password is resolved only when Daita opens the source. It is never persisted in source configuration.

#Probe Schemas

Applications can inspect available non-system schemas before attachment:

python
probe = await agent.probe_postgresql(
    host="db.example.com",
    database="analytics",
    username="daita_reader",
    credential=credential,
    ssl_mode="verify-full",
)
 
for schema in probe.schemas:
    print(schema.name, schema.has_base_tables)

The probe is bounded and does not persist a source registration.

#Attach

python
source = await agent.attach_postgresql(
    host="db.example.com",
    database="analytics",
    username="daita_reader",
    credential=credential,
    schemas=("public", "reporting"),
    port=5432,
    ssl_mode="verify-full",
    name="Analytics",
)

Equivalent source-record form:

python
from daita import PostgreSQLSource
 
source = await agent.attach(
    PostgreSQLSource(
        host="db.example.com",
        database="analytics",
        username="daita_reader",
        credential=credential,
        schemas=("public", "reporting"),
        ssl_mode="verify-full",
        name="Analytics",
    )
)

Supported SSL modes are disable, prefer, allow, require, verify-ca, and verify-full.

#Discovery

Daita catalogs base tables, columns, supported types, indexes, primary keys, and foreign-key relationships from only the selected schemas. PostgreSQL system schemas are excluded.

#Query Boundary

data_query_postgresql runs inside a read-only transaction with a bounded statement timeout. Daita:

  1. revalidates SQL against current catalog facts;
  2. reconnects through the admitted source registration;
  3. rechecks live structure;
  4. applies row and byte bounds;
  5. rolls back the transaction; and
  6. returns a JSON-safe result projection.

Only a deliberately bounded set of SQL functions and supported PostgreSQL types is accepted. Server functions capable of external I/O are outside the public query surface.

#Headless Attachment

bash
daita attach atlas postgresql \
  --host db.example.com \
  --database analytics \
  --username daita_reader \
  --password-env DAITA_POSTGRES_PASSWORD \
  --schema public \
  --schema reporting \
  --ssl-mode verify-full \
  --source-name Analytics