Connect operational data without turning every source into another silo.
A controlled integration plane connects approved databases, geospatial services, and SaaS APIs through PostgreSQL Foreign Data Wrappers, private transactional caches, and supervised Nango synchronization.
PostgreSQL FDW
Supported platform or deployment profile.
OGR FDW
Supported platform or deployment profile.
PostGIS
Supported platform or deployment profile.
Steampipe
Supported platform or deployment profile.
Nango
Supported platform or deployment profile.
Admin governed
Supported platform or deployment profile.
Use the right connection for each source.
Database and GIS sources remain queryable through PostgreSQL-compatible interfaces, while Nango-managed applications synchronize approved record models into a private JSONB cache.
PostgreSQL and PostGIS
01
Connect approved remote PostgreSQL or PostGIS databases through postgres_fdw using scoped read-only credentials.
Steampipe ecosystem
02
Register a TLS-protected Steampipe PostgreSQL service and select only the approved plugin schemas and tables required by the deployment.
Open and Esri GIS services
03
Use ogr_fdw with GDAL drivers for approved WFS, OGC API Features, and Esri FeatureServer query sources.
Nango-managed APIs
04
Synchronize configured provider models through Nango authentication, signed webhooks, cursor-based record retrieval, and a separately supervised worker.
Private source schemas
05
Provision generated fdw_* schemas that remain separate from the normal application role and public serving surfaces.
Last-known-good caches
06
Refresh selected source layers transactionally into integration_cache; a failed remote read rolls back and preserves the previous snapshot.
Controlled spatial publication
07
Publish only administrator-approved attributes from refreshed, public-classified spatial layers through optional OGC or Esri-compatible views.
Audited administration
08
Catalog sources, test connections, discover layers, provision, refresh, synchronize, review row counts and freshness, and audit changes from an admin-only workflow.
Keep source ownership while creating a controlled shared view.
The mesh does not expose raw sources directly. It separates connection, private access, cached operational use, and optional publication into explicit trust boundaries.
- Source-specific read-only credentials and exact host allowlists
- Private foreign schemas owned by a separate provisioner role
- Transactional refresh with schema fingerprint checks
- Last-known-good behavior when a source is unavailable
- Selected public attributes only at the publication boundary
Bring remote data into PostgreSQL governance without copying it blindly.
FDWs provide a familiar relational control surface for approved data sources, while the platform places a cache and publication boundary between remote systems and operational consumers.
Database federation
POSTGRES_FDW
Connect PostgreSQL, PostGIS, or a PostgreSQL-compatible Steampipe service through narrowly scoped tables and schemas.
Geospatial federation
OGR_FDW
Discover and read supported WFS, OAPIF, and Esri FeatureServer query layers through the deployed GDAL drivers.
Operational resilience
CACHE
Refresh into local tables within one transaction so partial failures do not replace a usable prior snapshot.
Explicit public surface
PUBLISH
Create a selected-column spatial view only after classification, refresh, geometry/SRID checks, and administrator approval.
Webhook → queue → worker → private cache
NANGO RECORD FLOW
A verified Nango sync notification creates an idempotent job and returns quickly. The supervised worker retrieves bounded record pages, applies inserts, updates, and deletes transactionally, advances the cursor, and records the result.
Connect SaaS and API records without exposing provider credentials.
Nango handles provider authentication and synchronization; the platform handles source approval, webhook verification, work supervision, cache ownership, retries, and operational visibility.
- Separate least-privilege API and webhook-signing keys
- HMAC verification of the raw webhook request
- Cursor pagination and bounded records per run
- Idempotent queue jobs and exponential retry backoff
- Full replacement or incremental merge with delete handling
- Private JSONB caches that cannot be published through the OGC action
Make every integration observable and reversible.
The admin-only workflow makes configuration, testing, provisioning, refresh, synchronization, publication, freshness, and failure state visible instead of burying integrations in one-off scripts.
Register
Test
Discover
Provision
Refresh
Publish
Monitor
Integration is a data-egress decision, not just a connector setting.
The feature ships disabled so each organization can approve exactly which sources, records, fields, hosts, credentials, and consumers belong in the mesh.
Separate privileged roles
IDENTITY
A dedicated provisioner performs FDW DDL; the normal application role does not own raw foreign servers or schemas.
Mounted, redacted credentials
SECRETS
Secret files remain outside the catalog, browser, API responses, and logs; source metadata stores only the approved reference.
TLS and exact egress
NETWORK
Host allowlists, certificate validation, narrow ports, Kubernetes NetworkPolicy, and gateway controls constrain remote access.
Private by default
CLASSIFY
Raw FDW schemas and Nango caches remain private; publication is a separate public-spatial approval workflow.
Measured failure behavior
RESILIENCE
Timeouts, retries, cached snapshots, row-count checks, drift alerts, and recovery runbooks protect operational consumers.
Administrator accountability
AUDIT
Only integration administrators can test, manage, provision, synchronize, or publish, with actions recorded for review.
An integration plane that can fit your service architecture.
The implemented feature is the application’s data and service-integration control plane. It can operate within customer Kubernetes, gateway, zero-trust, or service-mesh standards, but it does not by itself claim a bundled Istio or Linkerd deployment.
- FastAPI administration and governed application APIs
- Dedicated Nango and provider workers under supervision
- PostgreSQL/PostGIS integration and cache plane
- Kubernetes NetworkPolicy and customer-controlled egress
- Optional external service mesh, mTLS, tracing, or traffic policy defined by deployment
Data mesh versus infrastructure mesh
CLEAR PRODUCT BOUNDARY
The product catalogs, connects, caches, synchronizes, and governs data services. Cluster-level sidecars, mutual TLS between every workload, traffic splitting, and service-mesh observability remain infrastructure choices that must be implemented and accepted in the target environment.
Know what still requires operating work.
CURRENT FOLLOW-UPS
- Scheduled FDW refresh and cancellation
- Source removal and orphan reconciliation
- Authenticated gateway for direct OGC serving
- Exact-provider integration and load testing
- Schema-drift and stale-cache alerting
- Customer service-mesh implementation, if required
Test the actual source, driver, network, and failure mode.
Unit and contract tests verify the control plane, validation, permissions, migrations, and admin workflow. They do not prove connectivity or performance against every remote database, GDAL service, Steampipe plugin, or Nango provider.
Turn connected data into governed operational value.
Feed approved information into mapping, analytics, operational records, and validated external interfaces.
Mapping & navigation
GIS
Use approved operational and geospatial layers in connected field and command workflows.
Analytics
INSIGHT
Build governed measures from accepted sources, refreshes, and quality boundaries.
Operational records
RECORDS
Connect approved reference data without collapsing record ownership and permissions.
Interoperability
API
Combine the mesh with webhooks, NG911, TAK, health exchange, identity, and devices.
Bring the sources, APIs, schemas, providers, data classifications, and service architecture you must support.
We will map connector paths, cache and publication boundaries, secrets, network policy, Nango models, administration, observability, and production acceptance tests.