# Instaclustr

## Instaclustr PostgreSQL

This config is for a NetApp Instaclustr managed PostgreSQL cluster.  The collector discovers the cluster's nodes through the Instaclustr API using a read-only provisioning API key, and connects with a password over verified TLS.  Add the collector's egress address to the cluster's firewall allowlist.  The monitoring user needs `pg_monitor`.

```toml
[dbgorilla]
agent_id  = "<agent id from the app>"
tenant_id = "<tenant id from the app>"
secret    = "${DBG_SERVER_SECRET}"

[[component]]
name   = "orders-instaclustr"
engine = "postgres"

[component.provider]
type         = "instaclustr"
cluster_id   = "<cluster id>"
provider     = "AWS_VPC"
region       = "US_EAST_1"
api_username = "you@example.com"
api_key      = { env = "IC_READONLY_API_KEY" }

[component.auth]
method   = "password"
user     = "dbgorilla_monitor"
password = { env = "INSTACLUSTR_DB_PASSWORD" }

[component.connect]
host     = "203.0.113.10"           # any current node address; discovery finds the rest
port     = 5432
ssl_mode = "verify-full"
ca_cert  = "/etc/dbgorilla/instaclustr-cluster-ca.pem"

[topology]
interval = "60s"

[commands]
enabled = true
allowed = ["explain", "collect_statistics"]   # see https://www.dbgorilla.com/docs/reference/collector-commands/#database-commands
```

The cluster's CA certificate is under **Connection Info** in the Instaclustr console.

Run the collector with the `docker run` from
[Self-managed PostgreSQL](/docs/connect/self-managed/#self-managed-postgresql), and add a read-only
mount for the certificate.  `secrets.env` holds `DBG_SERVER_SECRET`, `IC_READONLY_API_KEY` and
`INSTACLUSTR_DB_PASSWORD`:

```sh
docker run --rm \
  -v "$PWD/collector.toml:/etc/dbg-collector/collector.toml:ro" \
  -v "$PWD/instaclustr-cluster-ca.pem:/etc/dbgorilla/instaclustr-cluster-ca.pem:ro" \
  --env-file secrets.env \
  dbgorillapublic.azurecr.io/dbg-collector:latest \
  --config-file /etc/dbg-collector/collector.toml
```