PostgreSQL & MySQL
catalog.schema.tableWhat you need
| Field | Notes |
|---|---|
| Host, port | Reachable from the internet, or over your own tunnel |
| Database | One catalog is one database |
| User, password | A read-only role is enough unless you intend to write |
| SSL mode | Defaults to require |
| Schema | Optional. Limits metadata collection on large databases |
| Read-only | Optional. Blocks writes at attach time, whatever the SQL says |
Connection poolers
If you connect through a pooler, use its session mode, not transaction mode.
Thunderduck's engine uses cursors and prepared statements, which a
transaction-mode pooler does not support. On Supabase, for example, that means
port 5432 rather than 6543, and the tenant-qualified username the pooler
expects.
A read-only role, scoped to a schema
Sensible for anything shared:
CREATE ROLE thunderduck_ro LOGIN PASSWORD '…';
GRANT USAGE ON SCHEMA analytics TO thunderduck_ro;
GRANT SELECT ON ALL TABLES IN SCHEMA analytics TO thunderduck_ro;
ALTER DEFAULT PRIVILEGES IN SCHEMA analytics
GRANT SELECT ON TABLES TO thunderduck_ro;A role restricted this way also keeps your other schemas out of the Tables page, since metadata collection only sees what the role can read.
Writing
Both types are writable by default. CREATE TABLE … AS SELECT and INSERT
work if the role permits them and the catalog is not marked read-only.