--- title: "Connect PostgreSQL / Supabase to Rig — Rig guide" description: "Connect Postgres, Supabase, RDS or Cloud SQL to Rig with a read-only role and sync a schema into your warehouse on a schedule." canonical: "https://rig.so/guides/connect-postgres" format: markdown --- Search guides, references, playbooks…⌘K Browse guides # Connect PostgreSQL / Supabase to Rig Rig Ingest copies the tables in one Postgres schema into your warehouse on a schedule. The same card covers Supabase, Amazon RDS, Cloud SQL and self-hosted servers, and it accepts server and client certificates for databases that insist on them. ## Before you start - You need the host, port and database name, and a network path from Rig to the server. If the server restricts inbound traffic, [contact us](https://rig.so/contact) for the addresses to allow. - You need a role that can create other roles and grant privileges. - If your server uses certificates, have the PEM files to hand. On Cloud SQL they are `server-ca.pem`, `client-cert.pem` and `client-key.pem`. ## Step 1: Create a read-only Postgres role Give Rig a role that can log in and read one schema. It does not need to write anything. 1. Connect to the database with an admin role. 2. Create the role with `CREATE ROLE rig_reader LOGIN PASSWORD 'a-strong-password';`. 3. Allow it to connect and see the schema: `GRANT CONNECT ON DATABASE your_db TO rig_reader;` then `GRANT USAGE ON SCHEMA public TO rig_reader;`. 4. Allow it to read the tables: `GRANT SELECT ON ALL TABLES IN SCHEMA public TO rig_reader;`. 5. So that tables you add later are readable too, run `ALTER DEFAULT PRIVILEGES FOR ROLE IN SCHEMA public GRANT SELECT ON TABLES TO rig_reader;`. Default privileges only cover tables created by the named role, so repeat the statement for each role that creates tables, such as your migration role. Run each one as that role, as a member of it, or as a superuser. 6. Replace `public` with your own schema name in each statement if your tables live elsewhere. ## Step 2: Connect it in Rig New to Rig? Watch how to find Connections Adding a source needs a workspace owner, or a role with the Manage connections permission, on a workspace where you manage your own connections. If the Connectors tab says “Data ingestion for this workspace is managed by Rig”, ask an owner or Rig support to add the source. 1. In Rig, open `Connections`, choose the `Connectors` tab and go to `Sources & actions`. 2. Search for **PostgreSQL / Supabase**, open the card and click `Connect`. 3. **Dialect**: Leave it as `postgresql`. 4. **Host**: The server's host name. For Supabase or RDS, copy it from the project or instance connection details. 5. **Port**: Leave it at `5432` unless your provider gives you another port. 6. **Database name**: The database that holds your tables. 7. **Username**: The read-only role you created, such as `rig_reader`. 8. **Password**: That role's password. 9. **Schema to ingest**: Leave it as `public`, or enter the schema you granted access to. 10. **SSL mode**: Optional. Enter `require`, `verify-ca` or `verify-full`. Leave it blank to use TLS whenever the server offers it. 11. **Server CA certificate (PEM)**: Paste the server CA certificate to verify the server. You need it for `verify-ca` and `verify-full`, and can skip it otherwise. 12. **Client certificate (PEM)**: Optional. Paste it only if your server requires trusted client certificates. 13. **Client private key (PEM)**: Optional. The key that matches the client certificate. 14. Click `Continue`. Rig checks the credentials and lists the streams it can reach, so choose the ones you want and click `Connect`. 15. The source then syncs on its schedule, which is nightly unless you change it. To load data straight away, click `Sync` on its row; `Test` pulls a small sample first if you want to check the connection. ## What Rig pulls in PostgreSQL / Supabase lands in its own `postgres` schema in your warehouse: - **Tables**: the tables in the schema you name. After you click Continue, Rig lists them and you choose which to sync. - **Table structure**: column names and types, so Rig can describe each table when you ask questions about it. The tables come from your own database, so their names and columns match what you have there. ## Good to know - With a server CA certificate and no SSL mode, Rig uses `verify-ca`, which trusts any certificate that CA signed. Choose `verify-full` if you also want Rig to check that the certificate names the host. - Tables that sync incrementally of up to 5,000,000 rows are re-read in full once a week so Rig can notice deleted rows. That adds read load for a short time. Larger tables, and tables Postgres cannot estimate the size of, are not re-read, so their deletions are not tracked. - Each source reads one schema. Add the card again for another schema or database. - To disconnect PostgreSQL / Supabase, click the bin icon on the source's row under `Sources & actions`. Only whoever connected the source or a workspace owner can do this, and data already synced stays in the warehouse. ## What people use this for - Query your Postgres app database in plain English - Replicate Postgres into your warehouse for reporting - Work with Supabase and RDS data the same way - Ask Postgres questions from Claude, Cursor or ChatGPT [More ideas for using PostgreSQL](https://rig.so/integrations/postgres) ## PostgreSQL / Supabase documentation - [PostgreSQL: GRANT](https://www.postgresql.org/docs/current/sql-grant.html) - [PostgreSQL: ALTER DEFAULT PRIVILEGES](https://www.postgresql.org/docs/current/sql-alterdefaultprivileges.html) Was this guide helpful? Yes No --- - [This page as HTML](https://rig.so/guides/connect-postgres) - [Site map for language models](https://rig.so/llms.txt) - [API and agent documentation](https://rig.so/developers)