Skip to main content

Database Access

Auth Stack DB (cerebro-authstack-pg)​

This server is private — inside cerebro-auth-vnet. You must go through the toolbox container to reach it.

Via AuthStack Toolbox​

# Open a shell inside the VNet
az containerapp exec \
  --name authstack-toolbox \
  --resource-group testing \
  --command "/bin/sh"

# Inside the container — get credentials from Key Vault first (see below)
# Then connect
psql "host=cerebro-authstack-pg.private.postgres.database.azure.com \
  port=5432 \
  dbname=keycloak \
  user=<admin-user> \
  password=<password> \
  sslmode=require"

Getting the admin password​

az keyvault secret show \
  --vault-name cerebro-auth-kv-62be6d5f \
  --name <postgres-secret-name> \
  --query value -o tsv

Common psql commands​

-- List databases
\l

-- Connect to a database
\c keycloak

-- List tables
\dt

-- Check Keycloak users
SELECT username, email FROM user_entity LIMIT 20;

-- Check OpenFGA tuples
SELECT * FROM tuple LIMIT 10;

-- Quit
\q

Assistant Agent DB (assistant-agent-pg-62be6d5f)​

This server may have public access enabled (Central India).

# Direct connection
psql "host=assistant-agent-pg-62be6d5f.postgres.database.azure.com \
  port=5432 \
  dbname=assistant_agent \
  user=<admin-user> \
  sslmode=require"

# Or via Azure CLI
az postgres flexible-server connect \
  --name assistant-agent-pg-62be6d5f \
  --resource-group assistant-agent-rg \
  --admin-user <admin-user> \
  --admin-password <password>

Running Migrations​

Most services run migrations automatically on startup. To run manually:

# Exec into the service container
az containerapp exec \
  --name review-service \
  --resource-group testing \
  --command "/bin/sh"

# Then run the migration command for that service

Backup and Restore​

# Restore auth DB to a point in time
az postgres flexible-server restore \
  --resource-group testing \
  --name cerebro-authstack-pg-restore-$(date +%Y%m%d) \
  --source-server cerebro-authstack-pg \
  --restore-time "2026-05-29T00:00:00Z"