Deployment considerations

Before deploying Postgres Enterprise Manager, consider these factors.

Considerations	Implementation instructions
What specification of servers do I need to run PEM?	Sizing PEM deployments
Does my EDB subscription cover my planned use of PEM?	Platform Compatibility
Is a standalone server sufficient or do I need a high availability architecture?	Installing the server or Platform Compatibility
Do I need to implement connection pooling?	Platform Compatibility
How will I manage generation and renewal of SSL certificates?	Deciding on an SSL model
What type of user authentication should I use?	Authentication options
What actions should I take to avoid security vulnerabilities?	Securing your deployment
Where should I host the web server?	Platform Compatibility

• How PEM licensing works
  • Licensing rules
  • Examples
    • Adding PEM to a fully supported environment
    • Adding unsupported servers to PEM
• PEM server and agent connection management mechanism
  • Without PgBouncer
  • With PgBouncer
• Authentication options
  • 1. Two-factor authentication (2FA)
  • 2. Kerberos authentication
    • Linux-based kerberos
    • Windows active directory (SSPI)
• Deciding on an SSL model
  • Certificate management models
• Securing your deployment
  • Web server security configuration
    • Recommendations applied by default
      • Disable insecure SSL and TLS protocols
      • Disable web server information exposure
      • Disable directory listing
      • Cross-site tracing
    • Optimize HTTP headers for security
      • X-Frame-Options
      • Content-Security-Policy
      • Strict-Transport-Security
      • X-Content-Type-Options
      • X-XSS-Protection
      • Cookie security
    • Additional recommendations that can be applied manually
      • Secure HTTPD with SSL certificates
      • Run the web server from a non-privileged user account
  • PEM application security configurations
    • Session timeout
    • RestAPI header customization
      • PEM_HEADER_SUBJECT_TOKEN_KEY
      • PEM_HEADER_TOKEN_KEY
      • PEM_TOKEN_EXPIRY
    • Role-based access control in PEM
    • Password management
    • Run PEM agent jobs with a non-root user
    • Changing the PEM agent and PEM backend database server certificates
• Web server installation options
  • PEM server and web server on separate hosts
  • PEM server and web server on the same host
• Sizing PEM deployments
  • Factors affecting resource requirements
    • Number of agents/connections
    • Size of frequently accessed data - memory
    • Rate of probe and alert execution - CPU and alert threads
  • PEM t-shirt sizing
• High availability patterns for PEM deployment
  • Running multiple instances of the PEM backend database
    • A primary
    • Connections must go to the primary
  • Running multiple PEM web application instances
  • Upgrading an HA PEM deployment
  • Load balancers, proxies, and VIPs
    • Using a virtual IP (VIP) managed by the failover manager
    • Using a load balancer
  • Reference architectures
    • C1: Colocated with single endpoint
    • S1: Separated with single endpoint for database
    • CM: Colocated with multi-host connection strings
    • SM: Separated with multi-host connection strings