23.1. Security #
duckdb.postgres_role#Specifies the Postgres Pro role that is allowed to use DuckDB execution and manage secrets. If the specified role does not exist when running
CREATE EXTENSION pgpro_axe, this role is created automatically.Default value:
""— superusers only.Access: Requires a restart.
duckdb.disabled_filesystems#Disables storages for pgpro_axe.
Possible values:
LocalFileSystem: Disable local storages.S3FileSystem: Disable S3 storages.HTTPFileSystem: Disable network storages.
By default, the local storage is disabled:
Example 23.2.
postgres=> show duckdb.disabled_filesystems; duckdb.disabled_filesystems ----------------------------- LocalFileSystem (1 row)
To specify multiple storages, separate their names with commas without spaces:
Example 23.3.
postgres=# ALTER SYSTEM SET duckdb.disabled_filesystems TO 'LocalFileSystem,HTTPFileSystem'; ALTER SYSTEM -- after server reboot -- postgres=# show duckdb.disabled_filesystems; duckdb.disabled_filesystems -------------------------------- LocalFileSystem,HTTPFileSystem (1 row)Access: Superuser-only.
duckdb.autoinstall_known_extensions#Specifies whether known extensions can be automatically installed when a DuckDB query depends on them.
Possible values:
true
false
By default, only superusers can execute
duckdb.install_extensionandduckdb.autoload_extension. This prevents other users from installing extensions that can have security implications or interfere with database operation.Users can only use extensions that DuckDB marked as auto-installable. To restrict the use of these extensions to a specific list of allowed extensions, set
duckdb.autoinstall_known_extensionsto false.Default value: true.
Access: Superuser-only.
duckdb.autoload_known_extensions#Specifies whether known extensions can be automatically loaded when a DuckDB query depends on them.
Default value: true.
Access: Superuser-only
duckdb.allow_community_extensions#Specifies whether community extensions can be installed.
Default value: false.
Access: Superuser-only.
duckdb.unsafe_allow_execution_inside_functions#Allows DuckDB execution inside Postgres Pro functions.
Important
This feature can cause Postgres Pro AXE to crash and is disabled by default.
Default value: false.
Access: Superuser-only.
duckdb.enable_external_access#Allows DuckDB to access external resources (e.g., HTTP, S3).
Important
This feature can cause Postgres Pro AXE to crash and is disabled by default.
Default value: true.
Access: Superuser-only.