Database and Third-Party Applications in Distribution

Distribution supports the following versions of PostgreSQL:

• 17.x
• 16.x
• 15.x

Distribution HA requires an external database. Any configuration changes require restarting a Distribution node to take effect across the entire Distribution cluster.

Configure Number of Database Connections

To control how many connections a Distribution node can open to the database, set maxOpenConnections in the shared.database section of system.yaml:

shared:
  database:
    maxOpenConnections: 98

The default value of maxOpenConnections is 98. This is an upper limit. Under normal load a node uses far fewer connections, and you can lower this value if the database allows only a small number of connections.

Each node also keeps one connection open for database locks.

Use the following formula to determine the total number of connections required:

Total number of connections = (number of nodes) * (shared.database.maxOpenConnections + 1) + 50

The additional 50 are to provide extra capacity for situations where all database connection pools are exhausted.

Encrypt the Database Connection with TLS

To encrypt the connection between Distribution and PostgreSQL, set sslmode to verify-full in the database URL and point sslrootcert to the database CA certificate.

Linux Archive, RPM, Debian, and Docker Compose

To enable TLS for the database connection:

1. Copy the database CA certificate to the Distribution host.
2. Open $JFROG_HOME/distribution/var/etc/system.yaml.
3. Under shared.database, add sslmode=verify-full to the URL, and set sslrootcert to the path of the CA certificate:
   system.yaml

   shared:
     database:
       url: "jdbc:postgresql://<DB_HOST>:5432/distribution?sslmode=verify-full&sslrootcert=/path/to/ca.pem"

Helm

To enable TLS for the database connection:

1. Create a Secret that contains the database CA certificate:
   Shell

   kubectl create secret generic distribution-db-ca --from-file=ca.pem=<path-to-ca.pem>

2. In your values file, set the database URL, and mount the CA certificate from the secret:
   YAML

   database:
     url: "jdbc:postgresql://<DB_HOST>:5432/distribution?sslmode=verify-full&sslrootcert=/opt/jfrog/db-ca/ca.pem"
   common:
     customVolumes: |
       - name: db-ca
         secret:
           secretName: distribution-db-ca
   distribution:
     customVolumeMounts: |
       - name: db-ca
         mountPath: /opt/jfrog/db-ca
         readOnly: true

   • If you're using the JFrog Platform chart, put these keys under distribution:.
   • If you keep the database URL in a Secret (database.secrets.url), add the same parameters to the URL stored there.
3. Apply the updated values with helm upgrade.

Related Topics

• Database Support Matrix
• Distribution System Requirements and Platform Support
• Distribution Network Ports
• Software Dependencies Matrix
• Product Dependencies Matrix