PostgreSQL Database

Classifyre requires a PostgreSQL (14+) database to store application configuration, scan schedules, runner execution logs, and detected security findings.

Our official Helm chart supports three deployment modes for the database, configured via the postgres.mode value:

Embedded Database (default, for test/evaluation)
External Database (recommended for production)
CloudNativePG (CNPG) Operator (for cloud-native high availability)

One Database, One Schema per Workspace

All modes use a single database. Isolation between workspaces is achieved with schemas, not separate databases: the public schema holds only the workspace registry, and each workspace owns a dedicated ns_<uuid> schema containing all of its application tables, plus a pgboss_<uuid> schema for its job queue.

This means you size, back up, and connect to one database no matter how many workspaces you run. Migrations are applied per schema on every start, serialised across all API and worker replicas by a PostgreSQL advisory lock, so a rolling upgrade never migrates the same schema twice.

Backups cover everything. A standard logical or physical backup of the database captures the registry and every workspace schema together. There is no per-workspace backup step.

Database Modes

Embedded

Embedded PostgreSQL (`postgres.mode: embedded`)

In embedded mode, the Helm chart deploys a single PostgreSQL pod within your cluster namespace.

Usecase: Evaluations, sales demos, and local development.
Persistence: Enabled by default via a PersistentVolumeClaim (postgres.embedded.persistence.size: 20Gi).
Configuration Group: postgres.embedded.*

postgres:
  mode: embedded
  embedded:
    image:
      repository: postgres
      tag: "18"
    persistence:
      enabled: true
      size: 20Gi

Not for Production: Embedded mode runs a single database pod without replicas, automated backups, or high availability. Do not use this mode for production workloads.

External

External PostgreSQL (`postgres.mode: external`)

In external mode, Classifyre connects to a PostgreSQL database provisioned outside of the Helm chart namespace.

Usecase: Production environments, cloud-managed database instances (such as AWS RDS, GCP Cloud SQL, or Azure Database for PostgreSQL).
Configuration Group: postgres.external.*

postgres:
  mode: external
  external:
    host: "postgres-prod.internal.net"
    port: 5432
    database: "classifyre"
    username: "classifyre"
    existingSecret: "classifyre-db-secret"
    existingSecretPasswordKey: "db-password"

CNPG

CloudNativePG Operator (`postgres.mode: cnpg`)

For Kubernetes-native high availability, Classifyre can configure a Postgres cluster managed by the CloudNativePG (CNPG) operator.

Usecase: Highly-available, resilient in-cluster production deployments.
Replica Nodes: Deploys a multi-instance cluster (default: 3 instances) with automated failover and backup policies.
Configuration Group: postgres.cnpg.*

postgres:
  mode: cnpg
  cnpg:
    clusterName: "classifyre-cnpg"
    instances: 3
    imageName: "ghcr.io/cloudnative-pg/postgresql:17"
    storage:
      size: 20Gi

Connection Security (SSL)

You can enforce SSL mode for the connection between the NestJS API and the database using postgres.connection.sslMode.

Available options:

disable (default for local environments/embedded mode)
require (establishes SSL but does not verify CA)
verify-ca (verifies the server CA certificate)
verify-full (verifies both the server CA certificate and host name matches)

postgres:
  connection:
    sslMode: require

Credentials Management

For security, we highly recommend storing database passwords in pre-created Kubernetes Secrets rather than passing them in plain-text inside your Helm values file.

Using standard Kubernetes Secrets

Provide the name of the secret and the key hosting the password:

postgres:
  external:
    existingSecret: "my-custom-secret"
    existingSecretPasswordKey: "postgres-password"

Direct connection URI override

Alternatively, you can supply a pre-formatted DATABASE_URL string inside an existing secret:

postgres:
  external:
    existingSecret: "my-custom-secret"
    existingSecretUrlKey: "DATABASE_URL"