Who can use this feature?

• Unison admins and users who can manage Unison data sources
• Availability depends on your Unison plan and configuration

Unison's PostgreSQL connector is designed to ingest data through node-postgres (pg 8.x, currently 8.11+) over a pooled, read-only connection. Create a PostgreSQL connection to make source data available for ingestion jobs.

1. Create a read-only PostgreSQL user

We recommend creating a dedicated PostgreSQL role for Unison and limiting it to the database objects Unison needs to read. Run commands like the following as a PostgreSQL administrator, replacing the example names and password:

CREATE ROLE unison_ro_user
  WITH LOGIN
  PASSWORD 'replace-with-a-secure-password'
  NOSUPERUSER
  NOCREATEDB
  NOCREATEROLE
  NOREPLICATION;

GRANT CONNECT ON DATABASE your_database TO unison_ro_user;
GRANT USAGE ON SCHEMA your_schema TO unison_ro_user;
GRANT SELECT ON ALL TABLES IN SCHEMA your_schema TO unison_ro_user;

ALTER ROLE unison_ro_user
  SET default_transaction_read_only = on;

To grant the role read access to tables created later, the owner that creates those tables can also run:

ALTER DEFAULT PRIVILEGES IN SCHEMA your_schema
  GRANT SELECT ON TABLES TO unison_ro_user;

2. Make the database reachable

Unison must be able to reach your PostgreSQL host and port.

• If the database is behind a firewall, add Unison's outbound IP addresses to your allow list. Contact Support for the current IP addresses.
• If the database is reachable only through a corporate VPN, Unison cannot connect through an end-user VPN session. Provide a network-accessible endpoint, replica, or approved tunnel that exposes only the required source data.
• Configure TLS/SSL for the connection to match your PostgreSQL server. We recommend encrypted connections whenever traffic crosses a public or untrusted network.

3. Configure the PostgreSQL connection

1. Open the PostgreSQL connection workflow available in your Unison instance.
2. Enter the connection details shown in the form. Use the dedicated read-only PostgreSQL role you created above.
3. Save the connection and verify that Unison can reach the source database.

The exact navigation, supported fields, and network options depend on the released connector version.

How Unison protects the source database

Unison's PostgreSQL connector is designed to manage connections through a pooled pg.Pool. Ingestion runs inside read-only transactions using PostgreSQL session controls such as SET SESSION CHARACTERISTICS AS TRANSACTION READ ONLY and default_transaction_read_only.

The service-level controls complement the dedicated read-only database role. The database role remains the strongest protection because PostgreSQL enforces its permissions independently of the client.

FAQs

Question: How does Unison connect to the PostgreSQL database?

Answer: Unison connects using node-postgres (pg) 8.x (currently 8.11+). It is the native JavaScript PostgreSQL client and uses the PostgreSQL wire protocol rather than JDBC. Connections are managed through a pooled pg.Pool, with parameterized queries and TLS/SSL configured per connection.

Question: Does Unison connect to PostgreSQL in read-only mode?

Answer: Yes. Unison is designed to run ingestion inside read-only transactions using PostgreSQL session controls, and we recommend provisioning a dedicated read-only role so Unison cannot write to the source database. This does not rely on a connection-level read-only mode in node-postgres.