Add a Database — Crunchy Bridge

Crunchy Bridge is the easiest managed PG to monitor end-to-end. You get actual superuser access — not rds_superuser or azure_pg_admin or cloudsqlsuperuser, but real superuser. ALTER SYSTEM works. Most extensions are available without Crunchy support tickets. Configuration is just postgresql.conf via the Crunchy console.

Lock down the firewall first

Crunchy ships with a default firewall rule of 0.0.0.0/0 — the entire internet. Tighten this before doing anything else. In the Crunchy console under Networking → Firewall, add MonPG's egress range and remove the default open rule:

# Add rule: 20.107.185.112/29 → port 5432 → allow
# Then remove the default 0.0.0.0/0 rule.

Leaving the default open rule in place undoes most of what makes Crunchy a secure choice. We've seen this stay open for months on customer accounts. Don't be that customer.

Get the connection string

Crunchy console → your cluster → Connection → Postgres URI tab. Copy the postgres:// URL.

Onboard

1. app.monpg.app → Setup → Crunchy Data.
2. Hosted — Auto-setup.
3. Fill in: host, user (typically application), password, database (use postgres for cluster-level monitoring), sslmode=require.
4. Test connection → pick databases → Provision.

Extensions

Crunchy ships almost everything: pgaudit, pgstattuple, hypopg, pg_buffercache, pgvector, postgis, timescaledb (Apache edition), pg_cron, pg_partman, auto_explain. The notable absence in the default catalog is pg_wait_sampling — request it via support if you specifically need it.

For non-SPL extensions, plain CREATE EXTENSION works. SPL-bound ones (auto_explain, pgaudit, pg_cron) need:

ALTER SYSTEM SET shared_preload_libraries = 'pg_stat_statements,auto_explain,pgaudit';

Then trigger a restart from the Crunchy console. The console handles the actual restart cleanly (no instance flap), but the GUC change isn't live until you click that button.

Logs

Crunchy doesn't natively stream logs to a third party. Two options: set up a sink (Datadog, Papertrail, Sumo, Mezmo) and point MonPG at it via the generic syslog drain, or use agent mode and tail logs from a local mount. Most customers go with the syslog sink because they already have one.