Azure Database for PostgreSQL Flexible Server¶

Constraints¶

Custom extensions cannot be installed. pg_relay is deployed via SQL, as described in Why the Extension Can't Just Be Installed.
The admin user (configured when the server was created) has broad privileges, sufficient for every setup step here, but is not a true PostgreSQL superuser.
SSL is enforced by default on every connection.
Inbound connections are controlled by firewall rules at the server level. The machine running the Processor must be explicitly permitted through the firewall.

Step 1 — Add firewall rules¶

Before connecting, add a firewall rule for the machine you are running the setup commands from. If the Processor will run on a different machine, add a rule for that IP address as well.

Via the Azure Portal: go to your Flexible Server → Networking → Firewall rules → add the required IP ranges → Save.

Via the Azure CLI:

# Allow the machine running setup commands
az postgres flexible-server firewall-rule create \
  --resource-group your-resource-group \
  --name your-server-name \
  --rule-name allow-admin \
  --start-ip-address <your-ip> \
  --end-ip-address <your-ip>

# Allow the machine where the Processor will run (if different)
az postgres flexible-server firewall-rule create \
  --resource-group your-resource-group \
  --name your-server-name \
  --rule-name allow-Processor \
  --start-ip-address <Processor-ip> \
  --end-ip-address <Processor-ip>

Step 2 — Deploy the pgrelay schema¶

Connect using your admin username. Azure Flexible Server enforces SSL — if psql prompts about SSL, or the connection fails, set PGSSLMODE=require before running the commands:

export PGSSLMODE=require

psql -h your-server.postgres.database.azure.com \
     -U adminuser \
     -d your_database \
     -c "CREATE SCHEMA pgrelay;"

psql -h your-server.postgres.database.azure.com \
     -U adminuser \
     -d your_database \
     -f sql/pg_relay--1.0.sql

psql -h your-server.postgres.database.azure.com \
     -U adminuser \
     -d your_database \
     -f sql/pg_relay--1.0--1.1.sql

ALTER ROLE pgrelay WITH LOGIN PASSWORD 'choose-a-strong-password';

Step 4 — Configure the Processor connection¶

On the Processor machine, create the .pgpass file:

your-server.postgres.database.azure.com:5432:your_database:pgrelay:choose-a-strong-password

chmod 600 ~/.pgpass

Processor environment variables:

PGHOST=your-server.postgres.database.azure.com
PGPORT=5432
PGDATABASE=your_database
PGUSER=pgrelay
PGPASSFILE=/path/to/.pgpass
PGSSLMODE=require

Optional — full SSL certificate verification

For the strongest connection security, set PGSSLMODE=verify-full and provide the Azure root CA (certificate authority) certificate via PGSSLROOTCERT. Download it from the Azure Portal, under Networking → Download SSL certificate, for your server.

High availability¶

Azure Flexible Server's HA (high availability) mode pairs a primary with a standby in a different availability zone. The server's fully qualified domain name (FQDN) always resolves to the current primary. Failover is automatic, and the Processor's reconnect loop handles the brief outage the same way it handles the Aurora failover scenario described in Amazon Aurora.

Continue to Google Cloud SQL.