Documentation CLI 0.1.1 · development llms.txt

coldctl source add postgres

ImplementedLocal state write

Syntax

USAGE

coldctl source add postgres [OPTIONS] --name <NAME> <--url <URL>|--url-env <URL_ENV>>

Arguments & options

Option	Description / default
`--data-dir <PATH>`	Override the OS application data directory
`--name <NAME>`	Unique local source name (ASCII letters, digits, hyphens, underscores)
`--output <OUTPUT>`	Output format; JSON contains no resolved credentials [default: table] [possible values: table, json]
`--tls-ca-env <TLS_CA_ENV>`	Environment variable containing a PEM CA bundle for PostgreSQL/MySQL/MongoDB certificate validation
`--url <URL>`	Password-free postgres://, mysql:// or mongodb:// URL; supports sslmode=require\|disable
`--url-env <URL_ENV>`	Name of an environment variable holding the full URL; its value is never stored
`--password-env <PASSWORD_ENV>`	Name of an environment variable holding the password, resolved only when connecting
`-h, --help`	Print help

Examples

Replace configuration names, paths and JOB_ID with values from your installation. Examples are not executed by this page.

CLI

coldctl source add postgres --name production --url "postgresql://archive_reader@db.example.com:5432/app" --password-env ARCHIVE_DB_PASSWORD

CLI

coldctl source add postgres --name managed-pg --url postgres://reader@db.example.com/app --password-env PG_PASSWORD --tls-ca-env PG_CA_PEM

Operational notes

Set ARCHIVE_DB_PASSWORD in your process environment or secret manager before connecting. Alternatively use --url-env ARCHIVE_DATABASE_URL; only its variable name is persisted. Exactly one of --url or --url-env is required. Password-bearing --url values are rejected. Adding a source does not connect.

For a private CA, load PEM certificate contents into PG_CA_PEM and use --tls-ca-env PG_CA_PEM with an updated PostgreSQL connector. Only the reference is saved; no OS trust-store change is needed. The configured bundle supplies this source's trusted roots; certificate and hostname verification remain enabled. Custom CAs require TLS. Without a custom CA, system trust is used.

Output, placeholders & global flags

View exact CLI help

HELP OUTPUT

Configure one PostgreSQL TCP endpoint. TLS is required by default

Usage: coldctl source add postgres [OPTIONS] --name <NAME> <--url <URL>|--url-env <URL_ENV>>

Options:
      --data-dir <PATH>              Override the OS application data directory
      --name <NAME>                  Unique local source name (ASCII letters, digits, hyphens, underscores)
      --output <OUTPUT>              Output format; JSON contains no resolved credentials [default: table] [possible values: table, json]
      --tls-ca-env <TLS_CA_ENV>      Environment variable containing a PEM CA bundle for PostgreSQL/MySQL/MongoDB certificate validation
      --url <URL>                    Password-free postgres://, mysql:// or mongodb:// URL; supports sslmode=require|disable
      --url-env <URL_ENV>            Name of an environment variable holding the full URL; its value is never stored
      --password-env <PASSWORD_ENV>  Name of an environment variable holding the password, resolved only when connecting
  -h, --help                         Print help