PGDEV Ankara – PostgreSQL Security and High Availability

Date: 2025-11-29

Organiser: BiSoft Bilgi Teknolojileri A.Ş.

Venue: Hacettepe University Technopolis, Ankara

PGDEV Ankara

On 29 November 2025, I attended PGDEV Ankara, organised by BiSoft, as an individual participant. The programme contained two main sessions on PostgreSQL security and high availability. Muhammet Kurtoğlu presented the security session, and Hidayet Pınarakar presented the high-availability session. The technical details are based on the session subtitles [1], while BiSoft’s public event announcement also describes the high-availability session [2].

PostgreSQL Security

The first session addressed database security as a separate layer alongside application-level controls. Subjects included linking application users to database operations, connection tracking through application_name, restricting client access, user and role privileges, and audit logs. The discussion covered connection rules in pg_hba.conf, SCRAM-SHA-256 authentication, password complexity and password policy enforcement.

The SQL Firewall section addressed inspection of queries to mitigate SQL injection, permitted and blocked query patterns, rule administration, activity logging and query-rate restrictions. BiSoft's publicly described SQL Firewall and Password Profile tools are also relevant to these topics [3]. Database-side access control was discussed as an additional security boundary rather than a replacement for application security.

Data masking was covered using PostgreSQL Anonymizer, including static and dynamic masking, different data visibility for different database users, and protection of sensitive information when producing test datasets. Row-Level Security, backups and centralised inspection of logs were also included. The session distinguished merely retaining database logs from being able to audit and analyse them effectively.

Backups and High Availability

The second session examined PostgreSQL cluster continuity, failure scenarios and recovery procedures. Physical backups, write-ahead logs (WAL), pg_basebackup, pgBackRest and point-in-time recovery (PITR) were covered alongside the relationship between data loss and recovery time. Physical/streaming and logical replication were compared, as were synchronous and asynchronous replication modes and their effects on performance, latency and potential data loss.

The Patroni section addressed automatic failover after primary-node failure, planned switchover, leader election and avoidance of split-brain conditions. Related coordination and cluster components, including etcd, were also discussed. BFM and BFM4Patroni were presented in the context of centralised PostgreSQL/Patroni administration, performance monitoring, log inspection and alerting. These capabilities are also covered in BiSoft's 2025 technical description of BFM4Patroni [4].

The presentation concluded with restore testing, periodic failover exercises, monitoring and alerting, and documented operational procedures.

References

1. BiSoft (29 Nov 2025). PGDEV Ankara session subtitles (participant archive)
2. BiSoft. PG Dev Ankara: PostgreSQL High Availability Session
3. BiSoft. PostgreSQL Partnership: SQL Firewall, Password Profile and BFM
4. BiSoft (15 Mar 2025). BFM4Patroni Cluster Management