Add a database

The agent reads PostgreSQL, MySQL, MariaDB, SQL Server, Oracle and SQLite. It connects with a role you make for it, and before it keeps a connection it proves that role cannot write.

PostgreSQL. strata connect add postgres --name crm --environment prod asks for the URL without showing it: postgres://strata_reader:<pass>@db.internal:5432/crm. From a script, pipe it in: strata connect add postgres --name crm < url.txt. Never put a URL on the command line, where your shell's history keeps it.

MySQL and MariaDB. strata connect add mysql --name support --environment prod, the URL mysql://strata_reader:<pass>@db.internal:3306/support. The database in the URL is the one the agent reads.

SQL Server. strata connect add mssql --name billing --environment prod, the URL sqlserver://strata_reader:<pass>@db.internal:1433/billing. The database in the URL is the one the agent reads, every schema in it the login may see. The connection is encrypted and the server's certificate checked; add ?trustServerCertificate=true only for a server whose certificate you sign yourself, and ?instance=SQLEXPRESS for a named instance.

Oracle. strata connect add oracle --name claims --environment prod, the URL oracle://strata_reader:<pass>@db.internal:1521/ORCLPDB1, ending in the service name of the pluggable database. The agent speaks Oracle's protocol itself: no Instant Client to install. It reads every schema the user may see that Oracle does not maintain itself, by its names in Oracle's own case (CLAIMS.MEMBERS).

SQLite. strata connect add sqlite --file /data/app.db --name app opens the file read-only. There is no password to keep.

What happens when you add one. - The agent connects as the role in the URL and asks the server what that role may do. A role that may INSERT, UPDATE, DELETE, TRUNCATE or CREATE anything, by its own grants or another role's, or a superuser, is refused, and you are shown the lines that make one that cannot (see Make a read-only role). - A role that passes is kept: its URL goes to this machine's keyring, and only the host, port, database and user are written to the agent's folder. Once paired, the console's Connections lists the source, never its password. - --environment sets the source's tier: prod or production is prod; staging, test or qa is lower; dev, sandbox or local is sandbox. A source with none is prod. Your role's grants on that tier decide what you may read, and whether personal values reach you whole.

Afterwards. strata connect probe crm runs the proof again, and strata doctor proves every source each time it runs, so a grant someone adds later shows up red. strata reflect crm reads its schema into the map (see Reflect a source). strata connect remove crm forgets the source, its map and its URL.