rowsafe

module

v0.7.0 Latest Latest Go to latest Published: Oct 3, 2026 License: Apache-2.0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/rowsafe/rowsafe

Links

Open Source Insights

README ¶

Rowsafe

Sleep at night. Rowsafe backs up the databases you already run, lets you restore to any second, and proves every week that your backups actually restore. This repository is the open-source part of Rowsafe: the agent that runs on your servers, the rowsafe CLI, the installer and the MCP server for AI agents.

Everything that touches your data is here, under Apache-2.0, so you can read exactly what runs on your machines.

Documentation: rowsafe.sh/docs · Status: PostgreSQL 13–18, MySQL 8.0/8.4, MariaDB 10.6–11.4 and MongoDB 6.0–8.0 on Linux servers and in Docker. ClickHouse 24.8 to 26.8 too (restores to any second from the parts the agent copies as ClickHouse writes them). Redis is planned.

Get started

rowsafe login                                          # opens the dashboard to approve this machine
rowsafe hosts enroll-token                             # prints the install command for your server
curl -fsSL https://rowsafe.sh | sudo sh -s rse_…       # on the database server

The installer does the rest on the server: it installs the agent, sets up storage, finds PostgreSQL, shows you the plan and asks before turning on backups (and before restarting PostgreSQL, if that is needed). To set up from your workstation instead: rowsafe adopt app, then rowsafe apply app.

Rewind: continuous backups, restore to any second. Deleted rows by mistake? Restore a copy as it was just before, next to production, and bring the rows back.

rowsafe status                       # is everything protected?
rowsafe mark before-drop             # a named point (a Mark) you can go back to
rowsafe rewind copy app --at "14:04" # a copy as it was at 14:04, on your server; production isn't touched
rowsafe rewind compare app           # which rows are missing or changed in production
rowsafe rewind rows app public.orders  # bring the missing rows back (asks first)
rowsafe rewind database app --at "14:04"  # worst case: the whole database goes back (asks first; undo keeps working)

Proof: every week Rowsafe restores your latest backup into a scratch copy and checks it.

rowsafe proof app         # run the restore test now
rowsafe proofs app        # past results

Pulse: how your databases are doing.

rowsafe pulse             # a 0-100 score per database, with what to fix in plain language
rowsafe fix app           # let Rowsafe fix what pulse found (clean up tables, end a stuck session...)
rowsafe top app           # the queries that take the most time, and which got slower
rowsafe insights app      # largest tables, unused indexes, wasted space, vacuum
rowsafe tune app          # PostgreSQL settings that suit this server; asks, then applies (undo: rowsafe settings undo)

Guard: the safety net for AI agents and deploys. rowsafe mcp and the Claude Code plugin create a restore point before migrations and destructive SQL; the GitHub Action saves one before every deploy.

Full guide: Quickstart.

What's in this repository

Path	What it is
`cmd/rowsafe-agent`, `internal/agent`	The agent. Makes outbound HTTPS requests only and runs a fixed set of tasks: inspect, adopt, check, backup, restore test, restore point, a PostgreSQL restart when you ask for one, Rewind (a copy next to production, compare, bring rows back, rewind in place and undo) when you ask, health fixes you apply (VACUUM, ANALYZE, rebuilding or removing an index, cancelling a query, ending a session, removing an inactive replication slot), and PostgreSQL settings changes you choose (ALTER SYSTEM + reload, checked again on the server; never its own archiving settings).
`cmd/rowsafe`, `client`	The CLI.
`mcp`, `integrations/claude-code`	Guard: `rowsafe mcp`, an MCP server for AI assistants, and a Claude Code plugin that creates a restore point before migrations.
`integrations/github-action`	Guard in CI: a GitHub Action that saves a Mark (restore point) before every deploy, published as `rowsafe/action`.
`collect`	What the agent's monitoring reads: database and host metrics, locks, replication, query statistics, table insights and PostgreSQL settings.
`tune`	The settings that matter, explained; recommendations for a server's memory, CPUs and disk; and the values Rowsafe refuses.
`protocol`	The API types shared by the agent, the CLI and the Rowsafe service.
`internal/pgbackrest`, `internal/pginspect`	PostgreSQL backup and inspection.
`scripts/install.sh`	The installer served at `https://rowsafe.sh`.
`release`, `cmd/rowsafe-release`	Release signing and verification.

Safety by design

Never restarts your database on its own. When a change needs a restart, you choose when: the installer asks, or you click Restart in the dashboard or run rowsafe restart. AI agents can't restart it.
Plan before apply. You see every change before anything happens.
Fixes you choose, checked twice. Health fixes run only when a person applies one, from a fixed list (no arbitrary SQL). The agent looks every object up again and re-checks the conditions right before it acts: it never removes an index that backs a constraint or has been used since, never ends Rowsafe's own, replication or autovacuum sessions, and only ends the exact session that was found (same process and start time). DDL waits at most 5 seconds for locks, indexes are rebuilt and removed CONCURRENTLY, and VACUUM runs gently (vacuum_cost_delay). AI agents can't apply fixes.
Isolated restore tests and copies that can't touch production or its backups: a private socket, no network listener, no archiving into your bucket.
Rewind only when you ask, and undoable. Bringing rows back runs in one transaction by primary key (parents first, triggers off, a Mark saved first). Rewinding the whole database keeps the current data aside for undo, and any failure puts the original back and starts it again. Your data stays on your server: Rowsafe only sees table names and counts. AI agents can't restore anything.
Signed, verifiable releases with automatic rollback of a bad update. See verifying releases.
Your secrets stay on your server, and backups are encrypted before upload.
Backups go easy on your server. Backups and restore tests run at low CPU and disk priority (nice, ionice), so PostgreSQL comes first. pgBackRest uses one process on servers with up to 4 CPUs and two on bigger ones (process-max), and compresses with zstd. Copying each change to your bucket (archive-push, run by PostgreSQL) is left at normal priority so it never falls behind.
Monitoring is read-only and light. Short statement and lock timeouts on every query; heavier table checks run every 30 minutes, in the background, and back off when slow. ROWSAFE_COLLECT_QUERY_TEXT=false keeps query text on your server; ROWSAFE_MONITORING=false turns monitoring off.

Build from source

make build   # bin/rowsafe, bin/rowsafe-agent, bin/rowsafe-release
make test
make lint

Release builds are reproducible (make dist). Locally built agents run but never auto-update.

Contributing and security

Issues and pull requests are welcome; see CONTRIBUTING.md. Documentation lives in rowsafe/docs. Report vulnerabilities privately through GitHub security advisories (SECURITY.md).

License

Directories ¶

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL

Path	Synopsis
client Package client is a Go client for the Rowsafe user API.	Package client is a Go client for the Rowsafe user API.
cmd
rowsafe command Command rowsafe is the Rowsafe CLI.	Command rowsafe is the Rowsafe CLI.
rowsafe-agent command Command rowsafe-agent runs on each database host as the postgres user.	Command rowsafe-agent runs on each database host as the postgres user.
rowsafe-docker-control command Command rowsafe-docker-control lets the Rowsafe agent (a Docker sidecar) stop, start and restart exactly one container, the PostgreSQL container next to it, and, if its operator allows it, replace the agent's own container with the signed image of a newer release (or only that: ROWSAFE_CONTROL_UPDATE_ONLY=1), without ever giving the agent the Docker socket.	Command rowsafe-docker-control lets the Rowsafe agent (a Docker sidecar) stop, start and restart exactly one container, the PostgreSQL container next to it, and, if its operator allows it, replace the agent's own container with the signed image of a newer release (or only that: ROWSAFE_CONTROL_UPDATE_ONLY=1), without ever giving the agent the Docker socket.
rowsafe-release command Command rowsafe-release builds, signs and verifies agent release manifests.	Command rowsafe-release builds, signs and verifies agent release manifests.
collect Package collect gathers PostgreSQL and host metrics on the database host for Rowsafe's built-in monitoring.	Package collect gathers PostgreSQL and host metrics on the database host for Rowsafe's built-in monitoring.
integrations
github-action/test/mockapi command Command mockapi is a stand-in for the Rowsafe API, just enough for the GitHub Action's tests (rowsafe show, status, mark, marks).	Command mockapi is a stand-in for the Rowsafe API, just enough for the GitHub Action's tests (rowsafe show, status, mark, marks).
internal
agent Package agent runs on each database host.	Package agent runs on each database host.
chproxyroot Package chproxyroot is the root side of connection pooling for ClickHouse: root's copy of the agent (rowsafe-permissions chproxy-apply, started by rowsafe-chproxy-apply.path) installs chproxy and runs it in front of a ClickHouse HTTP port root allowed (/etc/rowsafe/pooler-allowed, `rowsafe-allow pooler`), the way the ProxySQL helper does for MySQL.	Package chproxyroot is the root side of connection pooling for ClickHouse: root's copy of the agent (rowsafe-permissions chproxy-apply, started by rowsafe-chproxy-apply.path) installs chproxy and runs it in front of a ClickHouse HTTP port root allowed (/etc/rowsafe/pooler-allowed, `rowsafe-allow pooler`), the way the ProxySQL helper does for MySQL.
dockerctl Package dockerctl is Rowsafe's container control for Docker: a tiny service (cmd/rowsafe-docker-control) that holds the Docker socket and stops, starts, restarts or inspects exactly one container, the PostgreSQL container next to it, when the Rowsafe agent asks over a Unix socket on a volume only the two of them share; and, only if its operator allows it (ROWSAFE_CONTROL_ALLOW_AGENT_UPDATE=1), replaces the agent's own container with the signed image of a newer release.	Package dockerctl is Rowsafe's container control for Docker: a tiny service (cmd/rowsafe-docker-control) that holds the Docker socket and stops, starts, restarts or inspects exactly one container, the PostgreSQL container next to it, when the Rowsafe agent asks over a Unix socket on a volume only the two of them share; and, only if its operator allows it (ROWSAFE_CONTROL_ALLOW_AGENT_UPDATE=1), replaces the agent's own container with the signed image of a newer release.
engine/clickhouse Package clickhouse is Rowsafe's ClickHouse engine: backups (ClickHouse's own BACKUP, full and differential, through an encrypting gateway inside the agent, into the customer's bucket), Proof (restore tests in a temporary server), Rewind (a copy at a backup or a Mark, compare, bring rows back), Marks, monitoring (Pulse) with two fixes (stop a query, cancel a stuck mutation) and discovery for the installer; restores to any second from the parts it copies as they appear (pitr_*.go).	Package clickhouse is Rowsafe's ClickHouse engine: backups (ClickHouse's own BACKUP, full and differential, through an encrypting gateway inside the agent, into the customer's bucket), Proof (restore tests in a temporary server), Rewind (a copy at a backup or a Mark, compare, bring rows back), Marks, monitoring (Pulse) with two fixes (stop a query, cancel a stuck mutation) and discovery for the installer; restores to any second from the parts it copies as they appear (pitr_*.go).
engine/mongodb Package mongodb is Rowsafe's MongoDB engine: backups (mongodump) and continuous oplog copying into the customer's bucket, encrypted on the server; Proof (restore tests), Rewind (a copy at any second, compare, bring documents back), Marks, monitoring (Pulse) and discovery for the installer.	Package mongodb is Rowsafe's MongoDB engine: backups (mongodump) and continuous oplog copying into the customer's bucket, encrypted on the server; Proof (restore tests), Rewind (a copy at any second, compare, bring documents back), Marks, monitoring (Pulse) and discovery for the installer.
engine/mysql Package mysql is the agent's MySQL and MariaDB engine: backups with Percona XtraBackup (MySQL) or mariadb-backup (MariaDB), streamed, compressed and encrypted on this server into the customer's bucket; continuous shipping of the binary logs for restores to any second; restore tests (Proof), copies to compare and bring rows back (Rewind), named points (Marks), monitoring (Pulse) and safe fixes.	Package mysql is the agent's MySQL and MariaDB engine: backups with Percona XtraBackup (MySQL) or mariadb-backup (MariaDB), streamed, compressed and encrypted on this server into the customer's bucket; continuous shipping of the binary logs for restores to any second; restore tests (Proof), copies to compare and bring rows back (Rewind), named points (Marks), monitoring (Pulse) and safe fixes.
handoff Package handoff seals secrets from one Rowsafe agent to another, so the control plane that relays them never sees them in the clear.	Package handoff seals secrets from one Rowsafe agent to another, so the control plane that relays them never sees them in the clear.
indexadvisor Package indexadvisor finds indexes that would make a database's slowest statements faster.	Package indexadvisor finds indexes that would make a database's slowest statements faster.
indexadvisor/sqlshape Package sqlshape extracts what a statement asks of its tables (indexadvisor.Shape) with PostgreSQL's own parser: libpg_query compiled to WebAssembly and run by wazero (github.com/wasilibs/go-pgquery), so the agent stays a pure Go, CGO-free binary.	Package sqlshape extracts what a statement asks of its tables (indexadvisor.Shape) with PostgreSQL's own parser: libpg_query compiled to WebAssembly and run by wazero (github.com/wasilibs/go-pgquery), so the agent stays a pure Go, CGO-free binary.
objstore Package objstore is a small S3 client (AWS Signature Version 4, path or virtual-host style, multipart uploads) for engines whose backups Rowsafe writes itself rather than through pgBackRest.	Package objstore is a small S3 client (AWS Signature Version 4, path or virtual-host style, multipart uploads) for engines whose backups Rowsafe writes itself rather than through pgBackRest.
objstore/fakes3 Package fakes3 is an in-memory S3 server for tests: PUT, GET (with a Range), HEAD, DELETE, ListObjectsV2 and multipart uploads, path-style, without signature checks (it only requires an Authorization header).	Package fakes3 is an in-memory S3 server for tests: PUT, GET (with a Range), HEAD, DELETE, ListObjectsV2 and multipart uploads, path-style, without signature checks (it only requires an Authorization header).
objstore/s3gw Package s3gw is the encrypting S3 gateway behind ClickHouse backups.	Package s3gw is the encrypting S3 gateway behind ClickHouse backups.
permissions Package permissions verifies one-click permission changes on the server itself: WebAuthn (passkey) signatures made in the Rowsafe dashboard, checked against the keys root paired at the terminal, with no network and no trust in the control plane that relays them (protocol/permissions.go).	Package permissions verifies one-click permission changes on the server itself: WebAuthn (passkey) signatures made in the Rowsafe dashboard, checked against the keys root paired at the terminal, with no network and no trust in the control plane that relays them (protocol/permissions.go).
pgbackrest Package pgbackrest renders pgBackRest configuration and wraps its CLI.	Package pgbackrest renders pgBackRest configuration and wraps its CLI.
pgbouncer Package pgbouncer talks to PgBouncer's admin console (the virtual "pgbouncer" database): SHOW commands for monitoring, and PAUSE, RELOAD and RESUME to switch servers without failing clients.	Package pgbouncer talks to PgBouncer's admin console (the virtual "pgbouncer" database): SHOW commands for monitoring, and PAUSE, RELOAD and RESUME to switch servers without failing clients.
pginspect Package pginspect reads state from a local Postgres over its Unix socket.	Package pginspect reads state from a local Postgres over its Unix socket.
pgscratch Package pgscratch starts a throwaway PostgreSQL cluster for integration tests (initdb and pg_ctl from PATH).	Package pgscratch starts a throwaway PostgreSQL cluster for integration tests (initdb and pg_ctl from PATH).
proxysqlroot Package proxysqlroot is the root side of connection pooling for MySQL and MariaDB: root's copy of the agent (rowsafe-permissions proxysql-apply, started by rowsafe-proxysql.path) installs and configures ProxySQL in front of a MySQL or MariaDB port root allowed (/etc/rowsafe/ pooler-allowed, `rowsafe-allow pooler`), the way the PgBouncer helper does for PostgreSQL.	Package proxysqlroot is the root side of connection pooling for MySQL and MariaDB: root's copy of the agent (rowsafe-permissions proxysql-apply, started by rowsafe-proxysql.path) installs and configures ProxySQL in front of a MySQL or MariaDB port root allowed (/etc/rowsafe/ pooler-allowed, `rowsafe-allow pooler`), the way the PgBouncer helper does for PostgreSQL.
tuneroot Package tuneroot is the root side of Tuning for MongoDB and ClickHouse: root's copy of the agent (rowsafe-permissions tuning-apply, started by rowsafe-tuning.path) writes the settings a person changed into files of Rowsafe's own, and nowhere else, only where root allowed it at install (/etc/rowsafe/tuning-allowed, `rowsafe-allow tuning`):	Package tuneroot is the root side of Tuning for MongoDB and ClickHouse: root's copy of the agent (rowsafe-permissions tuning-apply, started by rowsafe-tuning.path) writes the settings a person changed into files of Rowsafe's own, and nowhere else, only where root allowed it at install (/etc/rowsafe/tuning-allowed, `rowsafe-allow tuning`):
masking Package masking turns real values into realistic fake ones for Guard's safe copies.	Package masking turns real values into realistic fake ones for Guard's safe copies.
mcp Package mcp exposes a Rowsafe organization to AI assistants over the Model Context Protocol.	Package mcp exposes a Rowsafe organization to AI assistants over the Model Context Protocol.
pglog Package pglog reads PostgreSQL's server log: it parses the stderr (log_line_prefix), csvlog and jsonlog formats, classifies each message, removes literal values before anything leaves the server, and tails log files and journald for the agent (Run).	Package pglog reads PostgreSQL's server log: it parses the stderr (log_line_prefix), csvlog and jsonlog formats, classifies each message, removes literal values before anything leaves the server, and tails log files and journald for the agent (Run).
pgprobe Package pgprobe looks at a PostgreSQL port the way a stranger would: it connects, asks for TLS, and starts a login with a made-up user name ("rowsafe_outside_check") to see how far PostgreSQL lets it get.	Package pgprobe looks at a PostgreSQL port the way a stranger would: it connects, asks for TLS, and starts a login with a made-up user name ("rowsafe_outside_check") to see how far PostgreSQL lets it get.
preview Package preview is Guard's migration preview logic that doesn't need a database: splitting SQL into statements, recognising risky DDL, and turning what a migration did on a copy into a verdict with plain-words impact and suggestions.	Package preview is Guard's migration preview logic that doesn't need a database: splitting SQL into statements, recognising risky DDL, and turning what a migration did on a copy into a verdict with plain-words impact and suggestions.
protocol Package protocol defines the JSON contract between the Rowsafe control plane (rowsafed), the agent (rowsafe-agent) and the CLI (rowsafe).	Package protocol defines the JSON contract between the Rowsafe control plane (rowsafed), the agent (rowsafe-agent) and the CLI (rowsafe).
e2e Package e2e seals small secrets end to end between a person's browser (or the rowsafe CLI) and a Rowsafe agent, so the control plane that relays them only ever sees ciphertext.	Package e2e seals small secrets end to end between a person's browser (or the rowsafe CLI) and a Rowsafe agent, so the control plane that relays them only ever sees ciphertext.
release Package release signs and verifies agent release manifests.	Package release signs and verifies agent release manifests.
agentimages Package agentimages is the signed list of a release's Docker agent images: for each image variant ("pg17", "pg17-alpine", "clickhouse26.8"), the digest of ghcr.io/rowsafe/agent built for that release.	Package agentimages is the signed list of a release's Docker agent images: for each image variant ("pg17", "pg17-alpine", "clickhouse26.8"), the digest of ghcr.io/rowsafe/agent built for that release.
tune Package tune knows the PostgreSQL settings that matter: what each one does in plain words, which ones Rowsafe never changes, the values that suit a server (recommendations in the spirit of PGTune) and the values that must be refused because PostgreSQL might not start with them.	Package tune knows the PostgreSQL settings that matter: what each one does in plain words, which ones Rowsafe never changes, the values that suit a server (recommendations in the spirit of PGTune) and the values that must be refused because PostgreSQL might not start with them.