# Database Configuration

The configuration file must also specify a database.

The supported databases are SQLite3, PostgreSQL, MariaDB, MySQL. The configuration looks like this:

```undefined
[Database]
  DriverName = "sqlite3"
  DataSourceName = "/path/to/database"
  EncryptorMasterPassword = "password"
```

`DriverName` is the name of the datasource and can be either `sqlite3`, `mysql`, or `postgres`. For mysql, an example of a datasource name could be:

```undefined
`USER:PASSWORD@HOST:3306/DATABASE_NAME?parseTime=true`
```

and for postgreSQL:

```undefined
`postgres://USER:PASSWORD@HOST:5432/DATABASE_NAME?sslmode=disable`
```

`EncryptorMasterPassword` specifies a master encryption key used to protect database records. This key is not directly used to encrypt data (as explained [here](https://builder-vault-tsm.docs.blockdaemon.com/docs/tsm-security-overview)). Use any long random string here and make sure to keep a backup of it somewhere safe.

## Notes on options

### MySQL

On mysql the option:

```text
?parseTime=true
```

is required for Golang to get the correct time objects.

This is not required for MariaDB.

### PostgreSQL

The option:

```undefined
?sslmode=disable
```

is required when running against databases that uses self-signed certificates.

# Database permissions

The following permissions must be granted to the user referenced in the connection string for the TSM server to be able to setup and modify the database when needed:

DB Permissions

```text
SELECT, INSERT, UPDATE, DELETE, CREATE, ALTER, DROP, INDEX, REFERENCES
```

Note that MariaDB will ignore the REFERENCES permission, and SQLLite does not use permissions.