Database

Broch stores its data in PostgreSQL 14 or later. There are two options:

Option	Where it runs	Limitations	Platforms
Bundled	In a container on the same host as Broch	Backups are yours: lose the host without one and the data is gone. Encrypted at rest only if the host’s disk is.	Docker Compose (with-postgres, with-postgres-byo-cert), DigitalOcean
External	On a server you run, or a managed service such as Amazon RDS, Azure Database for PostgreSQL or DigitalOcean Managed Databases	One more service to run or pay for.	Docker Compose (with-postgres-external); the Azure Container Apps and AWS ECS Fargate modules create one

Bundled is the simplest. A managed external database adds backups and encryption at rest, which most production installs want. Either way Broch runs as one instance: see Scaling.

Bundled PostgreSQL

Pick a compose variant that bundles it, or the DigitalOcean module, which keeps it on a separate block storage volume. There’s nothing else to set up.

• Back it up. See Docker Compose → Backup or DigitalOcean → Backup.
• Check disk encryption if your compliance posture requires encryption at rest. Broch always encrypts its most sensitive fields, such as IdP refresh tokens and the license token, with your BROCH_MASTER_KEY (see Architecture & Security), but the rest of the database is only as encrypted as the volume it sits on.

External PostgreSQL

Create a database and a role for Broch, then pass the connection string as ConnectionStrings__BrochConnection. Use SSL Mode=VerifyFull: it checks the server’s certificate and host name as well as encrypting.

ConnectionStrings__BrochConnection=Host=<db-host>;Database=brochdb;Username=broch;Password=<password>;SSL Mode=VerifyFull

With Docker Compose, use the with-postgres-external variant and set BROCH_DB_CONNECTION_STRING in its .env; the compose file passes it on. Single-quote the whole value, and inside it double-quote a password containing ; (Password="a;b"). If your provider’s CA isn’t in the system trust store, as with RDS or DigitalOcean, the variant’s README shows where to put the CA file.

git clone https://github.com/broch-io/broch-deploy.git
cd broch-deploy/docker-compose/with-postgres-external

cp .env.example .env
$EDITOR .env       # set BROCH_DB_CONNECTION_STRING

docker compose up -d

Next: Wildcard Domain & DNS, step 2 of the self-managed checklist.