> ## Documentation Index
> Fetch the complete documentation index at: https://docs.seekr.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Provision PostgreSQL for SeekrFlow

> Create the PostgreSQL instance SeekrFlow stores its data in.

SeekrFlow persists data for its services in PostgreSQL 16 or higher. You create the instance. SeekrFlow creates its own databases and roles inside it during configuration.

## Create the instance

<Tabs>
  <Tab title="Amazon Web Services (AWS)">
    Create an Amazon Aurora PostgreSQL-Compatible Edition or Amazon Relational Database Service (Amazon RDS) for PostgreSQL database. See [Creating an Amazon Aurora DB cluster](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/Aurora.CreateInstance.html) or [Creating an Amazon RDS DB instance](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_CreateDBInstance.html).

    SeekrFlow connects to the database with a username and password, from inside your virtual private cloud (VPC). To set both, create the database with full configuration. Express configuration allows only AWS Identity and Access Management (IAM) authentication and places the database outside a VPC.

    If you use a serverless option, configure it so it never pauses or scales to zero. SeekrFlow keeps database connections open and expects the database to stay available.

    Use the settings in this table. For security and backups, follow your organization's requirements.

    | Setting | What SeekrFlow needs |
    | - | - |
    | Engine | Aurora (PostgreSQL Compatible) or PostgreSQL, version 16 or later. |
    | Storage | Start with 500 GB. Aurora grows storage automatically. |
    | Admin credentials | Any username and password. SeekrFlow uses this admin login to create its databases and run migrations. In the console, this is the **Master username** field. If you choose to manage the password in AWS Secrets Manager, get it from Secrets Manager before you [create the SeekrFlow secrets](/self-managed/flow/prepare/secrets-and-tokens). |
    | VPC | The VPC your cluster runs in. |
    | Security group | Inbound traffic on port 5432 from the cluster, such as from the cluster security group. A new security group created in the console allows only your own IP address. Add the rule for the cluster after you create the database. |
    | Public access | Not needed. If the instance is reachable only from inside the VPC, `sfe db setup` can create SeekrFlow's databases from a job in the cluster. |
  </Tab>

  <Tab title="On-premises">
    Run PostgreSQL on your own compute or as a stateful set in Kubernetes. The chart doesn't install PostgreSQL. Use the settings in this table. For security and backups, follow your organization's requirements.

    | Setting | What SeekrFlow needs |
    | - | - |
    | Engine | PostgreSQL 16 or later. |
    | Storage | Start with 500 GB. |
    | Admin credentials | An admin account SeekrFlow can use to create its databases and run migrations, such as `postgres`. |
    | Authentication | Password authentication. SeekrFlow connects with a username and password. |
    | Network access | Inbound traffic on port 5432 from the cluster. |
  </Tab>
</Tabs>

The chart runs database migrations during installation. The instance must be reachable from the cluster before you install.

## Check the instance

To confirm that the cluster can reach the instance, run `pg_isready` from a temporary pod. Replace `<instance-hostname>` with your instance endpoint.

```bash theme={null}
kubectl run pg-check --restart=Never --image=postgres --command -- pg_isready -h <instance-hostname> -p 5432
kubectl wait --for=jsonpath='{.status.phase}'=Succeeded pod/pg-check --timeout=120s
kubectl logs pg-check
```

The output includes `accepting connections`. Then delete the test pod:

```bash theme={null}
kubectl delete pod/pg-check
```

## Generate role passwords

SeekrFlow creates two login roles in the instance when you [connect SeekrFlow to PostgreSQL](/self-managed/flow/prepare/postgresql). Generate a password for each now:

```bash theme={null}
echo "seekrflow_app:      $(openssl rand -hex 24)"
echo "seekrflow_keycloak: $(openssl rand -hex 24)"
```

Store both somewhere safe. You enter them when you create secrets.

## Record the values

Note these values. You will enter them when you create the values file and secrets.

| Value | Used for | Example or format |
| - | - | - |
| Instance hostname | `global.defaults.postgres.host`, and the `pg-creds` secret: `PG_HOST` | The endpoint of your database instance. |
| Port | `global.defaults.postgres.port` | `5432` |
| Admin account name and password | `pg-creds` secret: `PG_USER`, `PG_PASS` | The admin credentials you set when you created the instance. SeekrFlow uses them for migrations. |
| Application role password | `pg-creds` secret: `PG_APP_PASS` | The password you generated for `seekrflow_app`. |
| Keycloak role password, if you enable Keycloak | `keycloak-credentials` secret: `db-password` | The password you generated for `seekrflow_keycloak`. |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.