Is the Postgres connection URL kept secret, and do I need to install a driver?

Tares stores the Postgres connection URL (the dsn) as a secret, redacts it in the API and omits it from catalog exports. The driver ships with Tares, so you install nothing extra. The only prerequisite is a Postgres that the Tares host can reach.

How it works

The Postgres connector polls a table incrementally and writes one event per new or changed row. It is one of the ways to bring your application’s own data into the timeline that AI SRE works from. The connection URL is the one setting that carries credentials, so Tares treats it differently from the rest of the config.

• Secret storage. The dsn field is typed as a secret. Its form is postgresql://user:pass@host:port/dbname, and it is the connection URL for that one source.
• Redaction in the API. When you read a source back through the API, the dsn is redacted, so the password does not come back to you.
• Catalog exports. When you export the catalog, the dsn is omitted. You can share an export without sharing database credentials.
• Driver included. The Postgres driver is part of Tares. You do not run a separate install step, and you do not add an extra package.
• Reachability. Tares polls the database from the Tares host, so that host must be able to connect to your Postgres. This is the only prerequisite.

The other settings, such as table, cursor_column and columns, are ordinary config values. Only the dsn is handled as a secret.

Set it up

1. Check that a Postgres is reachable from the machine that runs Tares. That is the whole prerequisite. You do not install a driver.
2. Add the source in the UI. Go to Sources → Add source → Postgres, enter the Connection URL (dsn) and select Discover. Tares lists the tables it can see. Pick one and it proposes the cursor, the entity key and the labels from the columns.
3. Choose which columns to pull. All columns are pulled by default. Then save.
4. Or ask a connected agent in plain words, for example: use tares to ingest the orders table, keyed by tenant_id. The agent calls discover_source to list tables and propose the cursor and labels, then test_source for a dry run that fetches sample rows, then create_source.
5. Or declare the source yourself. This is the same object you can send with POST /api/sources:

- name: orders
  connector: postgres
  poll: 10s
  config:
    dsn: postgresql://user:pass@host:5432/appdb
    table: orders
    cursor_column: updated_at
    columns: id,tenant_id,status,amount,updated_at   # empty = every column
    labels:
      - { name: tenant_id, field: tenant_id, primary: true }
      - { name: status, field: status }

6. Verify. Open the source. Recent events shows rows on the next poll, and Fields reports each column’s coverage, so you can confirm the key column is reliably present.

The full field list, including time_column, limit and text_template, is on the Postgres connector page.

What you get

• A connection URL that Tares stores as a secret, redacted in the API and omitted from catalog exports.
• No driver to install, so there is no extra package to track on the Tares host.
• A short path to a working source: a reachable Postgres, a connection URL and a table are enough.
• Discovery that lists the tables the connection can see and proposes the cursor, the key and the labels for you.
• One event per new or changed row, tracked on a cursor column that only grows, such as an autoincrement id or updated_at.
• Rows from your application’s source-of-truth data in the same timeline as your other signals.

When something else fits

• If the Tares host cannot reach your Postgres, fix the network path first. Reachability is the one thing the connector needs from you.
• If you want data from a JSON endpoint rather than table rows, the Postgres connector page is not the right fit. Use the http_poll connector instead.
• If you need a column that never grows as a cursor, pick a different table or column. The cursor must be a column that only ever increases.

Related