MIME-Version: 1.0
References: 
 <CADsUR0B9bcJQKYHyUMnWcODGzF5+AdeToawULkkTKfrq32Z-8w@mail.gmail.com>
 <64f1c69a-ceff-4b17-8298-58f255d075fc@gmail.com>
 <dde00623-b8e0-421b-a3f7-b149768894ef@app.fastmail.com>
 <fab6a5f3-df9f-4bd7-b2ac-434a17303547@gmail.com>
 <7f6e0ff9-05e9-4664-9c71-d9dd744362b9@gmail.com>
In-Reply-To: <7f6e0ff9-05e9-4664-9c71-d9dd744362b9@gmail.com>
From: Pavel Stehule <pavel.stehule@gmail.com>
Date: Thu, 19 Mar 2026 08:53:13 +0100
Message-ID: 
 <CAFj8pRC5jqo3DwOfXCyRh8hHMr8xWk3CTHV_XWsQPZ1Y7QV6PQ@mail.gmail.com>
Subject: Re: Read-only connection mode for AI workflows.
To: Andrei Lepikhov <lepihov@gmail.com>
Cc: Jack Bonatakis <jack@bonatak.is>,
 pgsql-hackers <pgsql-hackers@postgresql.org>,
	Bruce Momjian <bruce.momjian@enterprisedb.com>,
 Andres Freund <andres@anarazel.de>
Content-Type: multipart/alternative; boundary="0000000000007d3c30064d5bdeab"
Archived-At: 
 <https://www.postgresql.org/message-id/CAFj8pRC5jqo3DwOfXCyRh8hHMr8xWk3CTHV_XWsQPZ1Y7QV6PQ%40mail.gmail.com>
Precedence: bulk

--0000000000007d3c30064d5bdeab
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hi

=C4=8Dt 19. 3. 2026 v 8:44 odes=C3=ADlatel Andrei Lepikhov <lepihov@gmail.c=
om> napsal:

> On 16/3/26 22:01, Andrei Lepikhov wrote:
> > On 16/3/26 20:28, Jack Bonatakis wrote:
> >> On Mon, Mar 16, 2026, at 2:08 PM, Andrei Lepikhov wrote:
> >>> I believe the pg_readonly [1] extension does what you're looking for,
> so
> >>> you might want to give it a try.
> >> Please correct me if I am mistaken, but it looks like pg_readonly
> >> operates at the database or cluster level.
>
> Take a look at the [1] project. It's a simpler version of [2] that
> always switches to read-only mode.
> To use it, just have your connection pooler load the 'safesession'
> module. This will keep the session in read-only mode until it ends.
> There are no GUCs, and there is no way to change the mode, even for a
> superuser. Does this seem safe enough?
>
> We could improve it by restricting manual calls to specific utility
> operations, such as VACUUM or REINDEX. However, we would need some
> specifications first.
>

It doesn't cover  possibility to set GUC by set_config function

Regards

Pavel


> [1] https://github.com/danolivo/safesession/
> [2] https://github.com/pierreforstmann/pg_readonly
>
> --
> regards, Andrei Lepikhov,
> pgEdge
>
>
>

--0000000000007d3c30064d5bdeab
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div>Hi</div><br><div class=3D"gmail_quote gmail_quote_con=
tainer"><div dir=3D"ltr" class=3D"gmail_attr">=C4=8Dt 19. 3. 2026 v=C2=A08:=
44 odes=C3=ADlatel Andrei Lepikhov &lt;<a href=3D"mailto:lepihov@gmail.com"=
>lepihov@gmail.com</a>&gt; napsal:<br></div><blockquote class=3D"gmail_quot=
e" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204)=
;padding-left:1ex">On 16/3/26 22:01, Andrei Lepikhov wrote:<br>
&gt; On 16/3/26 20:28, Jack Bonatakis wrote:<br>
&gt;&gt; On Mon, Mar 16, 2026, at 2:08 PM, Andrei Lepikhov wrote:<br>
&gt;&gt;&gt; I believe the pg_readonly [1] extension does what you&#39;re l=
ooking for, so<br>
&gt;&gt;&gt; you might want to give it a try.<br>
&gt;&gt; Please correct me if I am mistaken, but it looks like pg_readonly =
<br>
&gt;&gt; operates at the database or cluster level. <br>
<br>
Take a look at the [1] project. It&#39;s a simpler version of [2] that <br>
always switches to read-only mode.<br>
To use it, just have your connection pooler load the &#39;safesession&#39; =
<br>
module. This will keep the session in read-only mode until it ends. <br>
There are no GUCs, and there is no way to change the mode, even for a <br>
superuser. Does this seem safe enough?<br>
<br>
We could improve it by restricting manual calls to specific utility <br>
operations, such as VACUUM or REINDEX. However, we would need some <br>
specifications first.<br></blockquote><div><br></div><div>It doesn&#39;t=C2=
=A0cover=C2=A0 possibility to set GUC by set_config function</div><div><br>=
</div><div>Regards</div><div><br></div><div>Pavel</div><div><br></div><bloc=
kquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:=
1px solid rgb(204,204,204);padding-left:1ex">
<br>
[1] <a href=3D"https://github.com/danolivo/safesession/" rel=3D"noreferrer"=
 target=3D"_blank">https://github.com/danolivo/safesession/</a><br>
[2] <a href=3D"https://github.com/pierreforstmann/pg_readonly" rel=3D"noref=
errer" target=3D"_blank">https://github.com/pierreforstmann/pg_readonly</a>=
<br>
<br>
-- <br>
regards, Andrei Lepikhov,<br>
pgEdge<br>
<br>
<br>
</blockquote></div></div>

--0000000000007d3c30064d5bdeab--