Supavisor

In the Azure Marketplace, search for Supavisor, select the SecureAnyCloud publisher, and click Create.

Configure the Network Security Group to allow TCP 22 for administration and TCP 6543 for the pooler from your client network. Add TCP 5452 as well if you plan to use session mode.

No inbound PostgreSQL port is required. The bundled PostgreSQL is loopback-only and is reached only through the pooler.

Create the resource group and VM, then open ports 22 and 6543.

RG="pooler-prod"; LOCATION="eastus"; VM_NAME="supavisor1" IMAGE_URN="sac1647283583153:supavisor-ubuntu-24-04:default:latest" SSH_KEY="$(cat ~/.ssh/id_rsa.pub)" az group create --name "$RG" --location "$LOCATION"
# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:supavisor-ubuntu-24-04:default:latest
az vm create \
  --resource-group "$RG" --name "$VM_NAME" \
  --image "$IMAGE_URN" \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values "$SSH_KEY" \
  --public-ip-sku Standard
az vm open-port --resource-group "$RG" --name "$VM_NAME" --port 22 --priority 1001
az vm open-port --resource-group "$RG" --name "$VM_NAME" --port 6543 --priority 1002

SSH in as azureuser and read the root-only credentials file. It contains the demo tenant's per-VM password and a ready-to-use pooler connection string.

sudo cat /root/supavisor-credentials.txt

Check that both services are active and see which ports are public. Only the pooler ports listen on all interfaces. The PostgreSQL port and the management API stay on loopback.

sudo systemctl is-active supavisor postgresql
sudo ss -tlnp | grep -E ':(6543|5452|4000|5432)' | awk '{print $4}' | sort -u

Connect to the demo tenant through the transaction pooler on port 6543. This example reads the demo password from the credentials file. From your own machine, use the connection string printed in Step 3.

The query shows that the client is proxied to the upstream PostgreSQL, and it returns real rows.

PW=$(sudo sed -n 's/^pooler.demo.password=//p' /root/supavisor-credentials.txt) PGPASSWORD="$PW" psql "host=127.0.0.1 port=6543 dbname=demo user=demo_user.demo sslmode=disable" \
  -c "SELECT current_user, inet_server_port() AS upstream_port, substring(version() from 'PostgreSQL [0-9.]+') AS server;" PGPASSWORD="$PW" psql "host=127.0.0.1 port=6543 dbname=demo user=demo_user.demo sslmode=disable" \
  -c "SELECT id, message, created_at FROM greeting;"

Supavisor stores its tenants and their users in the _supavisor schema of the metadata database. This is the multi-tenant model: each tenant maps to an upstream PostgreSQL, and each tenant user has a pool size and a pool mode.

sudo -u postgres psql -d supavisor \
  -c "SELECT external_id AS tenant, db_host, db_port, db_database, require_user FROM _supavisor.tenants;"
sudo -u postgres psql -d supavisor \
  -c "SELECT tenant_external_id AS tenant, db_user, mode_type, pool_size FROM _supavisor.users;"

Open several client connections through the pooler in quick succession, then look at the upstream PostgreSQL. Transaction pooling multiplexes many clients onto a small pool. The client connections are therefore served by only a handful of native backend connections, all labelled Supavisor.

PW=$(sudo sed -n 's/^pooler.demo.password=//p' /root/supavisor-credentials.txt) for i in $(seq 1 8); do PGPASSWORD="$PW" psql "host=127.0.0.1 port=6543 dbname=demo user=demo_user.demo sslmode=disable" -tAc 'select 1;' >/dev/null; done
sudo -u postgres psql -d demo \
  -c "SELECT usename, application_name, state, count(*) AS upstream_backends FROM pg_stat_activity WHERE usename='demo_user' GROUP BY 1,2,3;"

From your application or workstation, connect through the pooler with the connection string from Step 3. Use the transaction pooler on port 6543 for serverless and high-concurrency workloads. Use the session pooler on port 5452 when you need a full PostgreSQL session. The same credential works on both, and the port selects the mode.

# transaction mode (recommended for serverless / high concurrency)
psql "postgres://demo_user.demo:<password>@<public-ip>:6543/demo"
# session mode (a full PostgreSQL session; open TCP 5452 in your NSG first)
psql "postgres://demo_user.demo:<password>@<public-ip>:5452/demo"

To pool your own PostgreSQL, add a tenant through the loopback management API. Sign a JWT with the API_JWT_SECRET from /etc/supavisor/supavisor.env. Then create a tenant that references your upstream database and one or more users.

The example below is illustrative. Replace the bearer token with your signed JWT.

curl -sX PUT http://127.0.0.1:4000/api/tenants/myapp \
  -H "Authorization: Bearer <your-token>" \
  -H "Content-Type: application/json" \
  -d '{"tenant":{"db_host":"your-db.example.com","db_port":5432,"db_database":"appdb","require_user":true,"users":[{"db_user":"app","db_password":"<db-password>","pool_size":15,"mode_type":"transaction"}]}}'

Clients then connect as app.myapp on port 6543. See the Supavisor documentation for the full tenant and metrics API.