Supabase

Supabase uses the PostgreSQL guide below. What differs:

• SSL is locked to verify-full: the connection is always encrypted and verified. The SSL modes table below does not apply.
• Default port is 5432 and the database is usually postgres.
• Use the direct connection or the session pooler (port 5432). The transaction pooler (*.pooler.supabase.com on port 6543) is refused.
• DirectQuery is not available: tables are imported into a Data Table only.
• Supabase system schemas (extensions, graphql, realtime, vault, cron and others) are hidden.
• The SSH tunnel and On-premises (via Gateway) work as in the PostgreSQL guide.

Connect a PostgreSQL database to Fresco BI. Fresco BI only reads: it lists schemas, tables and columns, imports tables into a Data Table, or queries them live with DirectQuery.

Feature	Supported
Import	Yes
DirectQuery	Yes
SSL/TLS	6 modes, default require
SSH tunnel	Yes
Cloud	Yes
On-premises (via Gateway)	Yes

Prerequisites

• A PostgreSQL server and the name of the database to read.
• An administrator who can create a role and grant privileges.
• Either network access from Fresco BI to the server’s host and port (Cloud), an SSH bastion, or a Gateway Agent in the database’s network (On-premises).

Step 1: Create a read-only user

Connect as an administrator and run, once per schema you want to read:

CREATE ROLE fresco_reader WITH LOGIN PASSWORD '<strong-password>';
GRANT CONNECT ON DATABASE <database> TO fresco_reader;
GRANT USAGE ON SCHEMA <schema> TO fresco_reader;
GRANT SELECT ON ALL TABLES IN SCHEMA <schema> TO fresco_reader;

Tables created later are not covered by the grant above. Give the reader SELECT on future tables too (run it as the role that creates the tables, or name that role):

ALTER DEFAULT PRIVILEGES FOR ROLE <table_owner> IN SCHEMA <schema>
  GRANT SELECT ON TABLES TO fresco_reader;

Fresco BI lists only the schemas where the user has USAGE and only the tables and views it can SELECT. Fresco BI only reads, but still use a role that cannot write.

Step 2: Allow network access

Cloud. Allow inbound connections from Fresco BI’s outbound IP addresses (the setup guide beside the data source form lists them) on the database port (5432 by default).

• Amazon RDS / Aurora: add an inbound rule to the instance’s security group: type PostgreSQL, TCP 5432, source each IP as /32.
• Self-managed server: set listen_addresses in postgresql.conf so the server listens on a public interface, open the port in the host firewall, and add one pg_hba.conf line per IP, then reload:

hostssl  <database>  fresco_reader  <fresco-ip>/32  scram-sha-256

SSH tunnel. If the database is open only to a bastion host, keep Cloud and turn on the SSH tunnel in the form. Allow Fresco BI’s outbound IP addresses (the setup guide beside the data source form lists them) on the bastion’s SSH port, and allow the bastion to reach the database.

On-premises (via Gateway). If the database is inside your private network, choose On-premises (via Gateway); this panel then switches to the Gateway guide.

Step 3: Fill in the form

1. Connection type: Cloud or On-premises (via Gateway). For On-premises, pick the Gateway cluster.
2. Display name: the name your team sees in Fresco BI.
3. Host: the server’s DNS name or public IP, without https:// or a port.
4. Port: 5432 is filled in; change it if your server uses another port.
5. Database: the database name, e.g. analytics.
6. User and Password: the fresco_reader role from Step 1.
7. SSL mode: see the table below. Keep require or stronger.
8. CA certificate (PEM): shown for verify-ca and verify-full. Paste the CA that signed the server certificate (required for verify-ca); empty uses the system trust store for verify-full.
9. Connect through an SSH tunnel (bastion) (Cloud only): fill SSH host, SSH port (22), SSH user, SSH private key (OpenSSH or PEM) and Key passphrase (if any). Keys must be Ed25519 or RSA of at least 3072 bits. The first test shows the bastion’s key; compare it with the fingerprint from your administrator and click Trust this key, then test again.
10. Click Test connection, then Save.

SSL modes

Mode	What it does
disable	No encryption
allow	Encrypts only when the server requires it
prefer	Encrypts when the server supports it
require (default)	Always encrypts; the certificate is not checked
verify-ca	Encrypts and checks the certificate is signed by a trusted CA
verify-full	Encrypts, checks the CA and the host name (most secure)

The CA certificate (PEM) field appears only for verify-ca and verify-full. verify-ca needs a CA certificate.

Troubleshooting

• The server rejected the user name or password. Check the user and password. Also check pg_hba.conf has a line for Fresco BI’s IP and this user.
• No connection could be opened to this host and port. Check the host, the port, and that the firewall allows Fresco BI’s IP. Add Fresco BI’s outbound IP addresses (the setup guide beside the data source form lists them) to the security group or firewall.
• The server refused the connection on this port: nothing listens there or a firewall rejects it. Check the port and listen_addresses.
• The server did not answer in time. Usually a firewall that drops packets, or a wrong host or port. Check the firewall rule and the host.
• The host name could not be resolved (DNS). Check the Host field. Use the full public DNS name.
• The host is in a blocked range (private, loopback or metadata). A database inside a private network needs an On-premises connection through a Gateway. Use the public address, or choose On-premises (via Gateway).
• The server certificate is not signed by a trusted CA. Paste the right CA into the CA certificate field. For RDS, paste the AWS RDS CA bundle for your region.
• The server certificate was not issued for the host name entered. Use the name in the certificate or a mode that checks the CA only. Enter the host name the certificate names, or use verify-ca.
• The server requires encryption but the chosen mode does not encrypt. Pick an encrypting SSL mode. Choose require or stronger.