Skip to main content

PostgreSQL wire protocol

The PostgreSQL wire protocol is the main door for the tools a customer already owns. A cell runs a native PostgreSQL v3 wire-protocol server, so standard ODBC and JDBC drivers, psql, Power BI, Tableau, DBeaver, and most other SQL clients connect without a System9-specific driver. It is the broadest and strongest connectivity surface on the platform.

Direction: inbound. System9 is the server. Status: Live.

What it is​

The server implements the PostgreSQL v3 startup and extended-query protocol, a pg_catalog mapper and virtual pg_* functions so clients that introspect the catalog behave, PostgreSQL error codes, and a per-database router. It is the same governed engine reached from the console, a second reach into one engine, not a second policy.

The platform also generates the connection recipe for you: a per-engine template registry emits ready-to-paste connection strings for JDBC, ODBC, psql, Power BI, and Arrow Flight, rendered on a connection card in the console.

Ports and TLS posture​

ListenerRoleDefault bindPortTLS
Node PG-wire gatewayThe external door0.0.0.09950In-band SSL on the same port (standard SSLRequest upgrade)
Data-service PG-wire serverIn-cell / loopback127.0.0.19650
TLS is an operator decision, not a default

require_tls on the external gateway defaults to off, the server answers a client's SSLRequest with an upgrade offer rather than demanding one. Enabling require_tls (so a non-TLS attempt is refused) is an operator choice that belongs in hardening guidance. TLS is not on by default.

Every login is a governed identity​

Authentication binds a credential to a directory entity, and a security guard attaches to the session so every statement is rewritten for row-level policy, checked for column-level policy, or denied, inside query execution.

This is the differentiator: two analysts with different clearances, connecting with their own credentials, see different rows and masked columns from the same query, because the policy is compiled into the plan, not layered onto the BI tool where a determined user could bypass it.

Client compatibility​

Power BI connects over its built-in PostgreSQL connector; Tableau, DBeaver, and other tools choose their PostgreSQL source type. See How-to · Connect a BI tool for step-by-step setup and troubleshooting.

"Connects to," not "certified"

Compatibility here means the platform speaks the protocol these clients speak. Compatibility here comes from the protocol, not from per-tool integrations: a client connects because it already speaks the PostgreSQL wire. A protocol-conformance suite replays the Power BI (NPGSQL) and JDBC startup sequences against the handler, which is evidence about the wire implementation rather than about any particular client build.

Across the deployment matrix​

The wire server runs on the cell with no vendor control plane in the path, so it behaves identically single-cell and multi-cell, cloud-enabled and sovereign/air-gapped. On an isolated network a tool on that network connects normally; federation gives one view over a catalog that spans cells.