omni_credentials

Overview

Version

Build

You can build the RPM / DEB packages for omnigres using pig build:

pig build pkg omnigres         # build RPM / DEB packages

Install

You can install omnigres directly. First, make sure the PGDG and PIGSTY repositories are added and enabled:

pig repo add pgsql -u          # Add repo and update cache

Install the extension using pig or apt/yum/dnf:

pig install omnigres;          # Install for current active PG version

pig ext install -y omnigres -v 18  # PG 18
pig ext install -y omnigres -v 17  # PG 17
pig ext install -y omnigres -v 16  # PG 16
pig ext install -y omnigres -v 15  # PG 15
pig ext install -y omnigres -v 14  # PG 14

dnf install -y omnigres_18       # PG 18
dnf install -y omnigres_17       # PG 17
dnf install -y omnigres_16       # PG 16
dnf install -y omnigres_15       # PG 15
dnf install -y omnigres_14       # PG 14

apt install -y postgresql-18-omnigres   # PG 18
apt install -y postgresql-17-omnigres   # PG 17
apt install -y postgresql-16-omnigres   # PG 16
apt install -y postgresql-15-omnigres   # PG 15
apt install -y postgresql-14-omnigres   # PG 14

Create Extension:

CREATE EXTENSION omni_credentials CASCADE;  -- requires: pgcrypto, omni_os

Usage

omni_credentials: Application credential management

The omni_credentials extension provides secure, encrypted credential storage with access control. It is a templated extension.

Setup

SELECT omni_credentials.instantiate(
    schema  => 'omni_credentials',
    env_var => 'OMNI_CREDENTIALS_MASTER_PASSWORD'
);

Credentials View

The primary interface is the credentials view:

Query and update the view directly; changes propagate automatically. Row-Level Security ensures only roles with grants on the principal can access credentials.

File Store (Development)

SELECT omni_credentials.instantiate_file_store(filename, schema);
-- Reload credentials from file:
SELECT credential_file_store_reload(filename);

Imports existing file records into the encrypted store and exports missing credentials from the table to the file. Auto-updates the file on credential changes.