Environment Variables

DATA_SOURCE_NAME="postgresql://username:password@hostname:5432/database?sslmode=disable"

DATA_SOURCE_NAME="user=postgres password=secret host=localhost port=5432 dbname=postgres sslmode=disable"

# Comma-separated for multiple databases (DEPRECATED)
DATA_SOURCE_NAME="port=5432,port=6432"

# Basic hostname
DATA_SOURCE_URI="localhost"

# With port
DATA_SOURCE_URI="localhost:5432"

# With database
DATA_SOURCE_URI="localhost:5432/postgres"

# With connection parameters
DATA_SOURCE_URI="localhost:5432/postgres?sslmode=require"

DATA_SOURCE_URI_FILE="/run/secrets/postgres_uri"

DATA_SOURCE_USER="postgres_exporter"

DATA_SOURCE_USER_FILE="/run/secrets/postgres_user"

DATA_SOURCE_PASS="secure_password"

DATA_SOURCE_PASS_FILE="/run/secrets/postgres_password"

docker run \
  -e DATA_SOURCE_URI="db.example.com:5432/postgres" \
  -e DATA_SOURCE_USER="postgres_exporter" \
  -e DATA_SOURCE_PASS_FILE="/run/secrets/db_password" \
  -v /path/to/password:/run/secrets/db_password:ro \
  quay.io/prometheuscommunity/postgres-exporter

PG_EXPORTER_WEB_TELEMETRY_PATH="/custom-metrics"

PG_EXPORTER_DISABLE_DEFAULT_METRICS="true"

PG_EXPORTER_DISABLE_SETTINGS_METRICS="true"

PG_EXPORTER_METRIC_PREFIX="postgres"
# Results in metrics like: postgres_up, postgres_database_size_bytes

PG_EXPORTER_COLLECTION_TIMEOUT="30s"

PG_EXPORTER_EXCLUDE_DATABASES="template0,template1,postgres"

PG_EXPORTER_INCLUDE_DATABASES="production,staging"

PG_EXPORTER_CONSTANT_LABELS="environment=production,region=us-east-1"

# Environment variable sets default
export PG_EXPORTER_WEB_TELEMETRY_PATH="/env-metrics"

# Flag overrides environment variable
postgres_exporter --web.telemetry-path="/flag-metrics"

# Result: metrics exposed at /flag-metrics

# Simple local connection
DATA_SOURCE_NAME="postgresql://postgres:password@localhost:5432/postgres?sslmode=disable"

# Recommended for production
DATA_SOURCE_URI="db.example.com:5432/postgres?sslmode=require"
DATA_SOURCE_USER="postgres_exporter"
DATA_SOURCE_PASS_FILE="/run/secrets/db_password"

# Local Unix socket connection
DATA_SOURCE_NAME="user=postgres host=/var/run/postgresql/ sslmode=disable"

DATA_SOURCE_NAME="postgresql://user:[email protected]:5432/postgres?sslmode=verify-full&sslrootcert=/etc/ssl/certs/ca-bundle.crt"

version: '3'
services:
  postgres_exporter:
    image: quay.io/prometheuscommunity/postgres-exporter
    environment:
      DATA_SOURCE_URI: "postgres:5432/postgres?sslmode=disable"
      DATA_SOURCE_USER: "postgres"
      DATA_SOURCE_PASS: "password"
      PG_EXPORTER_COLLECTION_TIMEOUT: "30s"
      PG_EXPORTER_DISABLE_SETTINGS_METRICS: "false"
    ports:
      - "9187:9187"

apiVersion: v1
kind: Secret
metadata:
  name: postgres-exporter-secret
type: Opaque
stringData:
  datasource: "postgresql://postgres_exporter:password@postgres:5432/postgres?sslmode=disable"
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: postgres-exporter
spec:
  template:
    spec:
      containers:
      - name: postgres-exporter
        image: quay.io/prometheuscommunity/postgres-exporter
        env:
        - name: DATA_SOURCE_NAME
          valueFrom:
            secretKeyRef:
              name: postgres-exporter-secret
              key: datasource

#!/bin/bash
# Production postgres_exporter configuration

# Data source
export DATA_SOURCE_URI="db.example.com:5432/postgres"
export DATA_SOURCE_USER="postgres_exporter"
export DATA_SOURCE_PASS_FILE="/run/secrets/postgres_password"

# Exporter settings
export PG_EXPORTER_WEB_TELEMETRY_PATH="/metrics"
export PG_EXPORTER_COLLECTION_TIMEOUT="30s"
export PG_EXPORTER_METRIC_PREFIX="pg"

# Disable certain features
export PG_EXPORTER_DISABLE_SETTINGS_METRICS="false"
export PG_EXPORTER_DISABLE_DEFAULT_METRICS="false"

# Start the exporter
exec postgres_exporter \
  --web.listen-address=:9187 \
  --collector.database_wraparound \
  --collector.long_running_transactions

# Good - uses file
DATA_SOURCE_PASS_FILE="/run/secrets/password"

# Bad - password in environment
DATA_SOURCE_PASS="my_password"

# Secure password file
chmod 600 /run/secrets/postgres_password
chown postgres_exporter:postgres_exporter /run/secrets/postgres_password

# Create Docker secret
echo "secure_password" | docker secret create db_password -

# Use in service
docker service create \
  --name postgres_exporter \
  --secret db_password \
  -e DATA_SOURCE_URI="postgres:5432/postgres" \
  -e DATA_SOURCE_USER="exporter" \
  -e DATA_SOURCE_PASS_FILE="/run/secrets/db_password" \
  quay.io/prometheuscommunity/postgres-exporter

# Create secret from file
kubectl create secret generic postgres-exporter \
  --from-file=password=/path/to/password-file

# Mount as file in pod
volumeMounts:
  - name: secrets
    mountPath: /run/secrets
    readOnly: true
volumes:
  - name: secrets
    secret:
      secretName: postgres-exporter

# View all PG_EXPORTER variables
env | grep PG_EXPORTER

# View data source configuration (be careful with passwords!)
env | grep DATA_SOURCE

# Test with psql
psql "$DATA_SOURCE_NAME"

# Or construct from parts
psql "postgresql://$DATA_SOURCE_USER:$DATA_SOURCE_PASS@$DATA_SOURCE_URI"

-- Grant necessary permissions
GRANT pg_monitor TO postgres_exporter;

-- Or for older PostgreSQL versions
GRANT pg_read_all_stats TO postgres_exporter;