# Configure PostgreSQL on TurboStack

Enable PostgreSQL on a host, choose a version, and let TurboStack auto-tune sizing for apps like Odoo and Medusa.

![The PostgreSQL panel on a host's Services tab, enabled, showing the Client only toggle, the version field, 3rd party Extensions, and Advanced Settings expanded to show Listen Addresses and Shared Buffers|1000](../../assets/screenshots/technologies/postgresql.png)

## Where to configure it

PostgreSQL is a host-level service. Open the host, go to its **Services** tab, and select **PostgreSQL**. Enable it and pick the major version. Saving updates the host YAML and provisions Percona PostgreSQL on that host.

## YAML configuration

### Required

| Key | Meaning |
|---|---|
| `postgresql_version` | The PostgreSQL major version to install, for example `"17"` (or newer). |

### Optional

| Key | Meaning |
|---|---|
| `postgresql_shared_buffers` | Memory used for caching. Auto-tuned to the server by default - override only with measured evidence. |
| `postgresql_listen_addresses` | The addresses PostgreSQL listens on, or `ANY` for every interface. Security-sensitive: keep it on localhost unless remote access is required. |
| `postgresql_extra_access` | A list of host-based access rules for specific networks or hosts. Each entry is a mapping with `type` (for example `host`), `database`, `user`, `address` (a network range or host) and `auth_method` (for example `scram-sha-256`). |
| `postgresql_extensions` | Extra extensions to install. Only `vector`, `postgis`, `timescaledb` and `pg_stat_statements` are accepted; any other name stops the deployment. |

```yaml
postgresql_version: "17"

# Optional overrides
postgresql_shared_buffers: "2GB"          # leave unset to keep auto-tuning
postgresql_listen_addresses: "localhost"  # widen only when needed
postgresql_extra_access:
  - type: host
    database: all
    user: gitlab_db
    address: 10.0.0.0/8
    auth_method: scram-sha-256
```

### Listening address

`postgresql_listen_addresses` takes an address, or the keyword **`ANY`**, which makes PostgreSQL
listen on every interface the server has.

> [!WARNING]
> `ANY` includes any public interface. A database reachable from the internet is a serious risk, so
> prefer a specific private address, and restrict access with the
> [firewall](../firewall/configure.md) whatever you choose. Widening the listen address is only half
> the job: a client also needs a matching rule in `postgresql_extra_access`.

> [!IMPORTANT]
> On a host that runs **Kubernetes or Docker**, PostgreSQL listens on every interface unless you set
> `postgresql_listen_addresses` yourself. If that is not what you want, set the address explicitly.

> [!WARNING]
> A major-version change requires a migration and is not a simple in-place switch. Back up first and test before applying it in production.

## Common tasks

- [import and export a PostgreSQL database](import-export-database.md)
- [connect to your PostgreSQL database remotely](connect-remotely.md)
- [create and manage PostgreSQL users](manage-database-users.md)

## Related

- [What is PostgreSQL?](what-is.md)
- [Services](../../platform/hosts/services.md)
- [Deploy Odoo](../../applications/odoo/deploy.md)