CLI & Configuration

The binary has exactly one job: start a node from a config file. There are no management subcommands — databases and users are managed over SQL (see Administration).

xcon-db-server -config /etc/xcon-db/xcon-db.toml
xcon-db-server -sample-config > xcon-db.toml   # annotated starting point

The config file

root = "/var/lib/xcon-db-server"

[listen]
pg   = ":5432"     # pg-wire (psql, Grafana, every pg driver)
ilp  = ""          # ILP TCP ingest; empty = off
ilp_db = ""        # the database ILP lines are bound to

[tls]              # pg-wire TLS; empty = plaintext
cert = ""
key  = ""

[engine]
group_commit   = "50ms"    # WAL fsync window ("0s" = fsync every write)
merge_every    = "30s"     # delta→columnar merge time trigger
merge_bytes    = 8388608   # ...and size trigger
merge_throttle = 0         # merge write budget bytes/s (0 = unlimited)

[admin]
user     = "xcon"
password = "change-me"

Keep the file private (chmod 600): it holds the admin password.

[admin] is the bootstrap (the postgres/sa pattern): the server guarantees this user exists with this password at every start, so a fresh data root needs no setup step. To rotate its password, change it here and restart. This one user cannot be altered or dropped over SQL — further admins can be created over SQL and are managed normally.

Administration over SQL

Connect as the admin (any client; with psql: psql "postgres://xcon:...@host:5432/xcon" — the database name is ignored for admins) and manage the node:

Statement	Meaning
SHOW DATABASES	Every database (admins); a database user sees its own
CREATE DATABASE acme	New empty database (names: [a-z0-9][a-z0-9_-]{0,63}); needs the CREATEDB switch
DROP DATABASE acme	Delete the database and its data; needs the DROPDB switch
SHOW USERS	List users (user, database, admin, owner, active, createdb, dropdb)
CREATE USER u PASSWORD 'p' DATABASE acme [OWNER]	New user bound to exactly one database; OWNER lets it manage that database's users
CREATE USER u PASSWORD 'p' ADMIN [CREATEDB] [DROPDB]	Another node admin, with its safety switches
ALTER USER u PASSWORD 'p'	Reset a password
ALTER USER u ENABLE|DISABLE	A disabled account keeps its data and settings but cannot log in
ALTER USER u CREATEDB|NOCREATEDB|DROPDB|NODROPDB	Flip an admin's safety switches
DROP USER u	Remove a user

Database and admin management is admin-only; CREATEDB/DROPDB are an admin's safety switches over database lifecycle — accident guards, not a privilege hierarchy (any admin can flip another admin's switch; the config-file admin holds both, always). User management is also delegated to owners: connected to its own database, an owner runs CREATE USER u PASSWORD 'p' [OWNER] (the database is implicit), ALTER USER (password, enable/disable), DROP USER and SHOW USERS, all scoped to that database. Any user may change its own password. Nobody drops or disables themselves, and the config-file admin is out of SQL's reach entirely. The admin session is management-only in return — data statements need a database user. Passwords are stored as SCRAM-SHA-256 verifiers, never in cleartext.