> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nofire.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# PostgreSQL

> Connect a read-only PostgreSQL role with NOFire AI

Connect PostgreSQL to bring query performance, lock activity, and table data into NOFire's system context. Before a deploy, that context shows what the change touches. When something breaks, the same signals are the evidence NOFire reasons over.

You authenticate with a read-only PostgreSQL role.

## Step 1: Create a Read-Only Role in PostgreSQL

<Accordion title="Create a Read-Only Role" defaultOpen>
  Connect to your database. Change the database and schema names to match your setup. Then create a role for NOFire:

  ```sql theme={null}
  CREATE ROLE nofire_readonly LOGIN PASSWORD '<password>';
  GRANT CONNECT ON DATABASE app TO nofire_readonly;
  GRANT USAGE ON SCHEMA public TO nofire_readonly;
  GRANT SELECT ON ALL TABLES IN SCHEMA public TO nofire_readonly;
  ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT ON TABLES TO nofire_readonly;
  GRANT pg_monitor TO nofire_readonly;   -- required to read other sessions in pg_stat_*
  ```

  <Note>
    Use a read-only role. NOFire runs every transaction with `default_transaction_read_only=on`, and a dedicated role makes that guarantee explicit for auditors.
  </Note>
</Accordion>

## Step 2: Add PostgreSQL Connection to NOFire AI

1. Go to **Connections**. Click **Connect** on **PostgreSQL**.
2. Enter a **Name** for the connection (for example, `production-app-db`).
3. Below **Name**, use the **DSN** / **Host / Database** buttons to switch modes. The form opens in **DSN** mode.

<Accordion title="DSN" defaultOpen>
  * **Connection String**: masked (for example, `postgresql://reader:password@db.example.com:5432/app?sslmode=require`)
</Accordion>

<Accordion title="Host / Database">
  * **Host**: for example, `db.example.com`
  * **Port**: defaults to `5432`
  * **Database**: for example, `app`
  * **User**: for example, `readonly_user`
  * **Password**: masked
  * **SSL Mode**: defaults to `require`. Options: `disable` (no TLS, local dev only), `allow`, `prefer`, `require` (encrypted, no cert check), `verify-ca`, `verify-full` (recommended for prod)
</Accordion>

Provide either a **Connection String**, or all of **Host**, **Database**, **User**, and **Password**.

**Statement Timeout (ms)** sits below the credentials in both modes. It defaults to `5000`.

<Tip>
  Use `verify-full` for production connections. `require` is the default in the form, but it does not check the server certificate.
</Tip>

Click **Save**. NOFire validates the credentials and creates the connection.