Install open_pg_tde

open_pg_tde runs on upstream PostgreSQL 16 and later. It does not require a vendor fork of the server. Because encryption relies on storage-manager and WAL extensibility that upstream PostgreSQL does not yet expose, you install open_pg_tde by applying a gated core patch to a PostgreSQL source tree and building it, then building the extension against that install.

From source (recommended) Prebuilt packages

Apply the open_pg_tde core patch to a stock PostgreSQL 16+ source tree, build with the hooks enabled, and build the extension against it. This is the supported path and works on any platform that can build PostgreSQL.

Install from source

Prebuilt DEB and RPM packages of open_pg_tde together with a compatible PostgreSQL build are planned. When available, they will be documented here.

Supported PostgreSQL versions

PostgreSQL major	Status
18	Supported
17	Supported
16	Supported
14 - 15	Not supported

The core patch is maintained as a per-major-version series, since the storage manager interface changes between PostgreSQL majors. See patches/postgresql/README.md in the source tree for the current status and the maintenance process.

On a supported version, open_pg_tde provides the tde_heap access method and encrypts tables, indexes, and WAL data.

Note

Support for the earlier tde_heap_basic access method has been removed. Use tde_heap.

Next steps

After finishing the installation, you can proceed with:

Set up open_pg_tde Learn about key management Validate your encryption setup Enable WAL encryption