Ridge Pgwire and Drivers

ridged exposes a bounded PostgreSQL-wire v3 subset on loopback. Pgwire is a transport contract; it does not make Ridge a PostgreSQL server.

Default endpoint

Keep the listener on loopback. For a remote host, use Ridge Admin's verified SSH direct-tcpip transport or an operator-controlled SSH connection.

Security configuration

The service recognizes the operator environment:

RIDGE_PGWIRE_PORT
RIDGE_PGWIRE_DATABASE
RIDGE_PGWIRE_USER
RIDGE_PGWIRE_PASSWORD
RIDGE_PGWIRE_READ_ONLY
RIDGE_PGWIRE_TLS_CERT
RIDGE_PGWIRE_TLS_KEY

Password authentication is cleartext inside the verified TLS channel. Ridge does not claim SCRAM, certificate identity, multi-role catalogs, or broad PostgreSQL privilege behavior. Protect the environment file with restrictive permissions.

Protocol surface

The daemon supports startup, SSL negotiation, simple query, and a bounded text Parse/Bind/Describe/Execute/Sync lifecycle. It preserves transaction/error status, parameter/result metadata, typed NULL, binary-safe text values, named/unnamed statements, bounded portal rebinding and batching, cancellation, and DISCARD ALL.

Unsupported features include COPY, general binary formats, JDBC relational Describe Portal, and broad catalogs.

Validated clients

Only the documented test settings and query shapes are claimed. An ORM can still fail if it expects PostgreSQL catalogs, server parameters, migrations, or binary encodings outside the subset.

Basic connection

psql -X -h 127.0.0.1 -p 7898 -U ridge -d ridge
pg_isready -h 127.0.0.1 -p 7898 -d ridge

Use a bounded connection pool. On disconnect, replay read-only work only when the caller explicitly allows it. Never replay a mutation whose acknowledgment was lost; its outcome is uncertain until verified.