Deployment considerations

There are a number of things to consider before deploying Postgres Enterprise Manager.

Considerations	Implementation instructions
Is a standalone server sufficient or do you need a high availability architecture?	Installing the server or Query information
Do you need to implement connection pooling?	Deploying connection pooling
What type of authentication to use?	Authentication options
What actions should you take to avoid security vulnerabilities?	Securing your deployment
Where to host the web server?	Query information

• Using Failover Manager for high availability
  • Initial product installation and configuration
  • Set up the primary node for streaming replication
  • Set up the standby nodes for streaming replication
  • Set up EFM to manage failover on all hosts
  • Current limitations
• Connection pooling using PgBouncer
  • PEM server and agent connection management mechanism
    • Without PgBouncer
    • With PgBouncer
  • Preparing the PEM database server
    • Prerequisites
    • Creating users and roles for PgBouncer-PEM connections
    • Updating the configuration files to allow PgBouncer-PEM connections
    • Creating the SSL key and certificate for PgBouncer-PEM authentication
  • Configuring PgBouncer
    • Prerequisites
    • Configuring PgBouncer
  • Configuring the PEM agent
    • Prerequisites
    • Configuring a new PEM agent
    • Configuring an existing PEM agent
• Authentication options
  • Configuring the PEM server to use Kerberos authentication
    • 1. Install Kerberos, the PEM server, and the PEM backend database
    • 2. Add principals on Kerberos server
    • 3. Extract key tables from Kerberos server
    • 4. Configure the PEM backend database server
    • 5. Obtain and view the initial ticket
    • 6. Configure the PEM server
    • 7. Browser settings
  • Configuring the PEM server to use Windows Active Directory domain services for Kerberos authentication (SSPI)
    • 1. Install Active Directory, the PEM server, and the PEM backend database server
    • 2. Create users in Active Directory to map with service principals
    • 3. Extract key tables from Active Directory
    • 4. Configure the PEM backend database server
    • 5. Obtain and view the initial ticket
    • 6. Configure the PEM server
    • 7. Browser settings
  • Configuring the PEM server to use two-factor authentication
    • Mail server configuration
• Securing your deployment
  • Web server security configuration
    • Recommendations applied by default
    • Optimize HTTP headers for security
    • Additional recommendations that can be applied manually
  • PEM application security configurations
    • Session timeout
    • RestAPI header customization
    • Role-based access control in PEM
    • SQL/Protect plugin
    • Password management
    • Run pemAgent jobs with a non-root user
    • Changing the pemAgent and PEM backend database server certificates
• Web server installation options
  • PEM server and web server on separate hosts
  • PEM server and web server on the same host