Deployment considerations

Before deploying Postgres Enterprise Manager, consider these factors.

Considerations	Implementation instructions
What specification of server(s) do I need to run PEM?	Sizing PEM Deployments
Does your EDB subscription cover your planned use of PEM?	Query information
Is a standalone server sufficient or do you need a high availability architecture?	Installing the server or Query information
Do you need to implement connection pooling?	Deploying connection pooling
What type of authentication should you use?	Authentication options
What actions should you take to avoid security vulnerabilities?	Securing your deployment
Where should you host the web server?	Query information

• How PEM licensing works
  • Licensing rules
  • Examples
    • Adding PEM to a fully supported environment
    • Adding unsupported servers to PEM
• Connection pooling using PgBouncer
  • PEM server and agent connection management mechanism
    • Without PgBouncer
    • With PgBouncer
  • Preparing the PEM database server
    • Prerequisites
    • Creating users and roles for PgBouncer-PEM connections
    • Updating the configuration files to allow PgBouncer-PEM connections
    • Creating the SSL key and certificate for PgBouncer-PEM authentication
  • Configuring PgBouncer
    • Prerequisites
    • Configuring PgBouncer
  • Configuring the PEM agent
    • Prerequisites
    • Configuring a new PEM agent
    • Configuring an existing PEM agent
• Authentication options
  • Configuring the PEM server to use Kerberos authentication
    • 1. Install Kerberos, the PEM server, and the PEM backend database
    • 2. Add principals on Kerberos server
    • 3. Extract key tables from Kerberos server
    • 4. Configure the PEM backend database server
    • 5. Obtain and view the initial ticket
    • 6. Configure the PEM server
    • 7. Browser settings
  • Configuring the PEM server to use Windows Active Directory domain services for Kerberos authentication (SSPI)
    • 1. Install Active Directory, the PEM server, and the PEM backend database server
    • 2. Create users in Active Directory to map with service principals
    • 3. Extract key tables from Active Directory
    • 4. Configure the PEM backend database server
    • 5. Obtain and view the initial ticket
    • 6. Configure the PEM server
    • 7. Browser settings
  • Configuring the PEM server to use two-factor authentication
    • Mail server configuration
• Securing your deployment
  • Web server security configuration
    • Recommendations applied by default
    • Optimize HTTP headers for security
    • Additional recommendations that can be applied manually
  • PEM application security configurations
    • Session timeout
    • RestAPI header customization
    • Role-based access control in PEM
    • Password management
    • Run PEM agent jobs with a non-root user
    • Changing the PEM agent and PEM backend database server certificates
• Web server installation options
  • PEM server and web server on separate hosts
  • PEM server and web server on the same host
• Sizing PEM Deployments
  • Factors affecting resource requirements
    • Number of agents/connections
    • Size of frequently accessed data - memory
    • Rate of probe and alert execution - CPU and alert threads
    • Size of historical data - storage
  • PEM t-shirt sizing
• High availability patterns for PEM deployment
  • Running multiple instances of the PEM backend database
    • A primary
    • Connections must go to the primary
  • Running multiple PEM web application instances
  • Upgrading an HA PEM deployment
  • Load balancers, proxies, and VIPs
    • Using a virtual IP (VIP) managed by the failover manager
    • Using a load balancer
  • Reference architectures
    • C1: Colocated with single endpoint
    • S1: Separated with single endpoint for database
    • CM: Colocated with multi-host connection strings
    • SM: Separated with multi-host connection strings