Sources & credentials
Configure PostgreSQL, MySQL and MongoDB with local secret references and verified TLS.
Connection choices
Install the matching postgres, mysql or mongodb connector before connecting. Use a password-free --url plus --password-env, or --url-env referencing a complete environment URL. Credentials resolve only at connection time. Local add/list/show/remove operations do not connect. Protect configuration metadata in local state.
coldctl source add mysql --name mysql-source --url mysql://archive_reader@db.example.com:3306/app --password-env MYSQL_PASSWORD --tls-ca-env DATABASE_CA_PEM
coldctl source add mongodb --name mongo-source --url mongodb://archive_reader@db.example.com:27017/app --password-env MONGO_PASSWORD --tls-ca-env DATABASE_CA_PEMTLS and secrets
Verified TLS is the default. --tls-ca-env references PEM CA text for MySQL or MongoDB, not a filename. PostgreSQL uses the platform trust store. URLs support sslmode=require|disable; use disable only for intentional local testing. MongoDB connects directly to one replica-set primary and authenticates against the configured database. Multi-host URLs, SRV URLs and automatic TLS downgrade are unsupported.
Discovery versus analysis
SQL discovery and analysis use catalogs, existing statistics and metadata estimates. MongoDB discovery may sample documents to identify fields and eligible shapes; it is not proof that every document is supported. Export validates each record. Estimates can be stale or unknown and are not exact eligible counts. None of these operations establishes source stability.
Database credentials and cloud storage identities
Database connections continue to use verified TLS and password environment references. AWS role authentication and Azure managed identity apply to storage in the agent and gateway, not to PostgreSQL/MySQL/MongoDB authentication. Cloud portal lifecycle tokens and gateway tenant bearer tokens are separate credentials.