{
 "slug": "postgresql",
 "name": "PostgreSQL",
 "tagline": "Relational database with native TLS and SCRAM authentication",
 "category": "database",
 "use_cases": [
  "relational-database",
  "sql",
  "application-backend"
 ],
 "aliases": [
  "postgres"
 ],
 "status": "live",
 "upstream": {
  "vendor": "PostgreSQL Global Development Group",
  "url": "https://www.postgresql.org",
  "license": "PostgreSQL",
  "license_url": "https://www.postgresql.org/about/licence/"
 },
 "image": {
  "os": "Ubuntu 24.04 LTS",
  "cis_level": 1,
  "ports": [
   5432,
   80,
   443
  ],
  "artifacts": [
   "/etc/lynxroute/sbom.json",
   "/etc/lynxroute/cis-report.html",
   "/usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md"
  ]
 },
 "clouds": {
  "aws": {
   "status": "live",
   "version": "18.6",
   "last_build": "2026-09-04",
   "entity_id": "prod-tzdw3ifhosxeq",
   "ami_alias": "/aws/service/marketplace/prod-tzdw3ifhosxeq/latest",
   "listing_url": "https://aws.amazon.com/marketplace/pp/prodview-hknxs2dmsvceu",
   "recommended_instance_type": "t3.medium",
   "price_usd_per_hour": 0.05,
   "free_trial_days": 5,
   "unit": "instance-hour"
  },
  "azure": {
   "status": "live",
   "version": "18.6",
   "last_build": "2026-08-19",
   "offer_id": "postgresql",
   "plan_id": "payg-gen2",
   "image_urn": "lynxroute:postgresql:payg-gen2:latest",
   "listing_url": "https://azuremarketplace.microsoft.com/en-us/marketplace/apps/lynxroute.postgresql?tab=Overview",
   "recommended_vm_size": "Standard_D2s_v3",
   "price_usd_per_vcpu_hour": 0.028,
   "unit": "vcpu-hour"
  },
  "alicloud": {
   "status": "not_offered"
  }
 },
 "urls": {
  "page": "https://lynxroute.com/products/postgresql/",
  "json": "https://lynxroute.com/products/postgresql/product.json"
 },
 "release_notes": [
  {
   "version": "18.6",
   "title": "PostgreSQL v18.6 + pgAdmin 9.17",
   "notes": "* Re-release of PostgreSQL 18.6. The application version is unchanged; this build refreshes the underlying operating system image\n* Includes the pgAdmin 4 web administration UI (server mode) behind the nginx TLS perimeter on 443 (/pgadmin4/); pgAdmin listens on loopback only, admin login generated per-instance at first boot\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base, picking up every operating-system security update published since the previous build\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-09-04",
    "azure": "2026-08-19"
   }
  },
  {
   "version": "18.6",
   "title": "PostgreSQL 18.6 + pgAdmin 9.17 - August 2026",
   "notes": "* Added the pgAdmin 4 web administration UI (v9.15, server mode) from the official pgAdmin apt repo\n* pgAdmin served only over HTTPS behind an nginx TLS perimeter on 443 (/pgadmin4/); binds to 127.0.0.1 only, never exposed directly\n* Admin login (email + random password) generated per-instance at first boot; appended to /root/postgresql-credentials.txt\n* No new database port opened - the UI is reached on 443, governed by your Security Group\n* PostgreSQL updated to 18.6 - security and bugfix release (2026-08-13) including CVE-2026-6471, which restricts logical decoding output plugins to the new output_plugin_libraries whitelist; only pgoutput and test_decoding are permitted by default. No dump/restore is required within 18.x. Note 18.5 was never released upstream\n* pgAdmin updated to 9.17\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-09-04",
    "azure": "2026-08-19"
   }
  },
  {
   "version": "18.4",
   "title": "PostgreSQL 18.4 - Initial release (June 2026)",
   "notes": "* PostgreSQL 18.4 on Ubuntu 24.04 LTS (official PGDG packages)\n* CIS Level 1 hardening applied (ansible-lockdown/UBUNTU24-CIS)\n* CVE-scanned before every release\n* scram-sha-256 auth required - superuser password and a sample application database generated at first boot\n* No trust authentication - every host connection requires scram-sha-256\n* Native TLS enabled at first boot with a per-instance self-signed certificate (sslmode=require)\n* Data checksums enabled; contrib modules (pg_stat_statements, pgcrypto, uuid-ossp) included\n* UFW firewall pre-configured (SSH on 22; 5432 governed by your Security Group)\n* fail2ban, auditd, AppArmor pre-configured\n* SBOM (CycloneDX 1.6) at /etc/lynxroute/sbom.json\n* CIS Conformance Report (OpenSCAP) at /etc/lynxroute/cis-report.html\n* IMDSv2 enforced\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-06-18",
    "azure": "2026-06-25"
   }
  }
 ],
 "release_history": [
  {
   "version": "18.6",
   "aws": "2026-09-04",
   "azure": "2026-08-19"
  },
  {
   "version": "18.4",
   "aws": "2026-06-18",
   "azure": "2026-06-25"
  }
 ],
 "deploy": {
  "aws_cli": "# subscribe once on the AWS Marketplace listing, then:\naws ec2 run-instances \\\n  --image-id resolve:ssm:/aws/service/marketplace/prod-tzdw3ifhosxeq/latest \\\n  --instance-type t3.medium --key-name my-key --security-group-ids sg-xxxxxxxx",
  "azure_cli": "# accept the plan terms once, then:\naz vm image terms accept --publisher lynxroute --offer postgresql --plan payg-gen2\naz vm create -g my-rg -n postgresql --size Standard_D2s_v3 \\\n  --image lynxroute:postgresql:payg-gen2:latest --admin-username azureuser --generate-ssh-keys"
 },
 "description": {
  "what_is": "PostgreSQL is a powerful, open-source object-relational database management system, implemented in C as a robust multi-process server with multi-version concurrency control (MVCC). It offers fully ACID-compliant transactions, the SQL standard plus rich extensions, native JSON and JSONB, full-text search, window functions, common table expressions, materialized views, table partitioning, GiST/GIN/BRIN indexing, stored procedures in multiple languages, logical and streaming replication, and a mature extension ecosystem (the contrib modules pg_stat_statements, pgcrypto and uuid-ossp ship in the image). It speaks the standard wire protocol, so it connects from every language through libpq, JDBC and ODBC drivers. Data is persisted on disk with write-ahead logging and page checksums enabled. Running it yourself in your own VPC keeps your data inside your AWS account rather than a managed service. PostgreSQL license, no vendor lock-in.",
  "image_adds": "Security hardening:\n* scram-sha-256 auth required - the postgres superuser password plus a sample application database and role are generated at first boot, never a default or empty password\n* No trust authentication anywhere - every host connection in pg_hba.conf requires scram-sha-256\n* Native TLS enabled at first boot with a per-instance self-signed certificate - no shared private key is baked into the image; clients connect with sslmode=require\n* Listens for VPC-internal access only - port 5432 is governed by your Security Group, not exposed to the internet\n* UFW firewall - SSH on 22 only; port 5432 governed by your Security Group\n* fail2ban, AppArmor\n* CVE scan - every image is scanned for vulnerabilities before release\n\nWeb administration (pgAdmin 4):\n* pgAdmin 4 web UI in server mode - browse schemas, run SQL, manage roles and backups from your browser\n* Served only over HTTPS behind an nginx TLS perimeter on 443 (per-instance self-signed certificate; swap in your own with certbot)\n* pgAdmin itself binds to 127.0.0.1 only - never exposed directly; the admin email and a random password are generated at first boot\n* No new database port is opened - the UI is reached on 443, governed by your Security Group\n\nOS hardening (CIS Level 1):\n* CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown\n* auditd, SSH hardening, Kernel hardening, IMDSv2 enforced\n\nCompliance artifacts:\n* SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json\n* CIS Conformance Report at /etc/lynxroute/cis-report.html\n* CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md"
 },
 "generated_at": "2026-10-31T09:36:34Z"
}