PostgreSQL (self-managed)

postgresqlDatabase36 lines

Your own Postgres server, reached from your API. Not needed when a backend already provides one.

Current — as published in v1.3.2. Written by hand for PostgreSQL (self-managed), not generated.

The rule

Where it may be used

Server-side only. No client application opens a database connection or holds a connection string — anything shipped to a device can be extracted from it, and that string grants full read and write access.

Queries

Parameterised only: WHERE id = $1. Never interpolate into SQL.
Name the columns; no SELECT *.
LIMIT anything unbounded.
Index every column used in WHERE, JOIN or ORDER BY, and confirm the planner uses it with EXPLAIN ANALYZE.

Connections

One shared Pool, never a connection per request.
Keep max low on serverless and put a pooler in front — each instance opens its own pool, and the server's connection limit is shared.
Always release a client acquired from the pool, in a finally.

Migrations

Files in db/migrations/, ordered, committed to git.
Backward-compatible with the deployed release. Add nullable, backfill, enforce later. Add the new column before dropping the old one.
CREATE INDEX CONCURRENTLY on live tables — a plain create takes a write lock and stalls the application.

Never

Never disable SSL verification to make a connection work.
Never run the application as a superuser.
Never log a connection string or query parameters containing personal data.

As each tool receives it

The same guidance, in the shape each editor reads. Cursor and Claude Code are written separately by hand; the rest are derived from the Cursor rule.

→ .cursor/rules/postgresql.mdchand-written for this tool

.cursor/rules/postgresql.mdc

---
description: PostgreSQL conventions
globs: ["server/**", "api/**", "db/**", "**/*.sql"]
alwaysApply: false
---

# PostgreSQL

## Where it may be used

**Server-side only.** No client application opens a database connection or holds
a connection string — anything shipped to a device can be extracted from it, and
that string grants full read and write access.

## Queries

- Parameterised only: `WHERE id = $1`. Never interpolate into SQL.
- Name the columns; no `SELECT *`.
- `LIMIT` anything unbounded.
- Index every column used in `WHERE`, `JOIN` or `ORDER BY`, and confirm the
  planner uses it with `EXPLAIN ANALYZE`.

## Connections

- One shared `Pool`, never a connection per request.
- Keep `max` low on serverless and put a pooler in front — each instance opens
  its own pool, and the server's connection limit is shared.
- Always release a client acquired from the pool, in a `finally`.

## Migrations

- Files in `db/migrations/`, ordered, committed to git.
- **Backward-compatible with the deployed release.** Add nullable, backfill,
  enforce later. Add the new column before dropping the old one.
- `CREATE INDEX CONCURRENTLY` on live tables — a plain create takes a write lock
  and stalls the application.

## Never

- Never disable SSL verification to make a connection work.
- Never run the application as a superuser.
- Never log a connection string or query parameters containing personal data.

What else this module writes

Selecting PostgreSQL (self-managed) contributes more than a rule file — all of it merged with every other module you pick, with conflicts resolved rather than duplicated.

Environment

DATABASE_URLrequiredConnection string. Server-side only.

PGSSLMODEoptionalSSL mode. Use `require` or stricter in production; never disable verification to make a connection work.

PGPOOL_MAXoptionalMaximum pool size per instance. Keep low on serverless — every instance opens its own pool.

Dependencies

pg^8.22.0@types/pg^8.20.0dev

Folders

db/migrations/server/database/

conflicts withSupabase

Put this in your repo

Adds PostgreSQL (self-managed) to a project this tool generated, without starting over. Files you have hand-edited are left alone.