pg_tde

Overview

works on percona postgres tde fork

Version

Install

You can install pg_tde directly. First, make sure the PGDG and PIGSTY repositories are added and enabled:

pig repo add pgsql -u          # Add repo and update cache

Install the extension using pig or apt/yum/dnf:

• Install
• pig
• dnf
• apt

pig install pg_tde;          # Install for current active PG version

pig ext install -y pg_tde -v 18  # PG 18
pig ext install -y pg_tde -v 17  # PG 17

dnf install -y percona-postgresql18       # PG 18
dnf install -y percona-postgresql17       # PG 17

apt install -y percona-postgresql-18   # PG 18
apt install -y percona-postgresql-17   # PG 17

Preload:

shared_preload_libraries = 'pg_tde';

Create Extension:

CREATE EXTENSION pg_tde;

Usage

pg_tde: Transparent Data Encryption for PostgreSQL

pg_tde provides Transparent Data Encryption (TDE) at the file level, encrypting tuples, WAL, and indexes. It works with the tde_heap access method and supports keyringfile and external Key Management Systems (KMS).

CREATE EXTENSION pg_tde;

Configuration

Add to postgresql.conf:

shared_preload_libraries = 'pg_tde'

Setting Up a Key Provider

-- File-based key provider (database-level)
SELECT pg_tde_add_database_key_provider_file('file_keyring', '/path/to/keyring');

-- Or global-level key provider
SELECT pg_tde_add_global_key_provider_file('file_keyring', '/path/to/keyring');

-- Set the encryption key using a database key provider
SELECT pg_tde_set_key_using_database_key_provider('my_key', 'file_keyring');

-- Or using a global key provider
SELECT pg_tde_set_key_using_global_key_provider('my_key', 'file_keyring');

Creating Encrypted Tables

CREATE TABLE sensitive_data (
    id serial PRIMARY KEY,
    secret text
) USING tde_heap;

All data in tables created with USING tde_heap is transparently encrypted on disk.

Checking Encryption Status

SELECT pg_tde_is_encrypted('sensitive_data');

Additional Functions

Notes

• Works only with Percona Server for PostgreSQL 17+
• Encrypts tuples, WAL, and indexes
• Does not yet encrypt temporary files and statistics