Enterprise Scale

-- Provision a tenant
CALL absdb_tenant_create('acme_corp', '{"quota_gb": 100, "max_connections": 500}');

-- Tear down (async — data purged within TTL window)
CALL absdb_tenant_drop('acme_corp');

-- Export full snapshot (GDPR portability)
CALL absdb_tenant_export('acme_corp', '/backups/acme_corp_2026.snap');

-- C API
absdb_tenant_create(db, "acme_corp", &opts);
absdb_tenant_drop(db,   "acme_corp");

# Connection pool settings
max_connections        = 65536      # virtual clients
pool_mode              = transaction # session | transaction | statement
pool_size              = 256        # real backend connections per database
pool_idle_timeout      = 30s
pool_max_lifetime      = 3600s
pool_reserve_pool_size = 5          # emergency slots

# Bootstrap a 3-node cluster
absdb-server --node-id 1 --cluster-init   --peers "node2:9091,node3:9091" --data-dir /data/node1

absdb-server --node-id 2 --join node1:9091 --data-dir /data/node2
absdb-server --node-id 3 --join node1:9091 --data-dir /data/node3

SELECT * FROM absdb_cluster_nodes;
-- node_id | address        | role     | log_index | state
-- 1       | 10.0.0.1:9091  | leader   | 18423     | healthy
-- 2       | 10.0.0.2:9091  | follower | 18423     | healthy
-- 3       | 10.0.0.3:9091  | follower | 18422     | healthy

-- RAID-1 mirroring across 2 nodes
CREATE TABLESPACE ts_mirror
  LOCATION '/data/primary'
  WITH (raid_mode = 1, replica_nodes = 'node2:9092');

-- RAID-5 parity across 4 nodes
CREATE TABLESPACE ts_parity
  LOCATION '/data/stripe'
  WITH (raid_mode = 5,
        stripe_nodes = 'node2:9092,node3:9092,node4:9092');

-- View balancer status
SELECT * FROM absdb_raid_balance_status;
-- node_id | throughput_mbs | status   | last_rebalance
-- 1       | 1240           | healthy  | 2026-04-05 14:22:00
-- 2       | 1180           | healthy  | 2026-04-05 14:22:00
-- 3       | 124            | slow     | rebalancing...

-- This WHERE clause is serialized to binary wire format
-- and executed AT the storage node, not the query coordinator.
-- Eliminates moving millions of rows across the network.
SELECT order_id, amount
FROM orders
WHERE status = 'pending' AND amount > 10000;
-- EXPLAIN shows: Remote Filter: (status = 'pending' AND amount > 10000)

-- Mark a column as conflict-free (CRDT)
ALTER TABLE inventory
  ALTER COLUMN stock_count SET CONFLICT_FREE CRDT_TYPE pn_counter;

-- Hybrid Logical Clock timestamp on every row
ALTER TABLE events
  ADD COLUMN hlc_ts HLC DEFAULT absdb_hlc_now();

-- View replication lag per region
SELECT region, lag_ms FROM absdb_geo_replication_status;

-- Pin table data to EU region
CREATE TABLE eu_customers (...) LOCALITY 'eu-west-1';

-- Cross-region query (coordinator fetches from remote)
SELECT c.name, o.amount
FROM eu_customers c JOIN us_orders o ON c.id = o.customer_id;

-- Data version control: branch per region for staging
CREATE DATABASE eu_staging FROM main LOCALITY 'eu-west-1';
SELECT * FROM absdb_branch_diff('eu_staging', 'main');

# LDAP authentication
ldap_enabled      = true
ldap_server       = ldap://ad.corp.example.com:389
ldap_bind_dn      = CN=svc-absdb,OU=ServiceAccounts,DC=corp,DC=example,DC=com
ldap_bind_password = {{ vault:ldap_svc_pass }}
ldap_base_dn      = OU=Users,DC=corp,DC=example,DC=com
ldap_user_filter  = (sAMAccountName={username})
ldap_group_filter = (memberOf=CN=DBUsers,OU=Groups,DC=corp,DC=example,DC=com)
ldap_tls          = starttls  # none | starttls | ldaps

-- Map an AD group to a DB role
CREATE ROLE db_readonly;
CALL absdb_ldap_map_group('CN=DBReadOnly,OU=Groups,DC=corp,DC=example,DC=com', 'db_readonly');

-- Verify mapping
SELECT * FROM absdb_ldap_group_mappings;

jwt_auth_enabled  = true
jwt_issuer        = https://auth.example.com/
jwt_audience      = absdb-production
jwt_jwks_uri      = https://auth.example.com/.well-known/jwks.json
jwt_jwks_refresh  = 3600   # seconds between JWKS cache refresh
jwt_claim_role    = db_role  # JWT claim mapped to DB role
jwt_require_https = true

-- Verify JWT status
SELECT absdb_jwt_validate('eyJhbGciOiJSUzI1NiIsInR5...');
-- Returns: {"sub":"alice","role":"analyst","exp":1775000000,"valid":true}

tls_mode          = require         # disable | allow | prefer | require | verify-full
tls_cert_file     = /etc/absdb/server.crt
tls_key_file      = /etc/absdb/server.key
tls_ca_file       = /etc/absdb/ca.crt
mtls_require      = true            # client cert mandatory
mtls_ca_file      = /etc/absdb/client-ca.crt

-- Grant connect from a specific mTLS identity
GRANT CONNECT FROM 'CN=analytics-service,OU=Services,DC=corp,DC=example,DC=com'
  TO ROLE analytics_reader;

-- Hot certificate rotation (zero downtime)
CALL absdb_zerotrust_rotate_cert('/etc/absdb/new-server.crt', '/etc/absdb/new-server.key');

-- View current node SVID
SELECT absdb_spiffe_svid();
-- spiffe://cluster.local/absdb/node/1

-- Grant access from a Kubernetes workload
GRANT CONNECT FROM 'spiffe://cluster.local/ns/payments/sa/checkout'
  TO ROLE payments_writer;

-- Verify peer SVID on an incoming connection
SELECT * FROM absdb_active_connections WHERE spiffe_id IS NOT NULL;

pkcs11_enabled    = true
pkcs11_lib        = /usr/lib/libCryptoki2_64.so  # HSM vendor library
pkcs11_slot       = 0
pkcs11_pin_env    = ABSDB_HSM_PIN               # PIN from environment variable
pkcs11_key_label  = absdb-master-key
pkcs11_operations = sign,unwrap,derive           # offloaded operations

-- Verify HSM is active
SELECT * FROM absdb_hsm_status;
-- hsm_vendor | model         | fips_level | slot | key_label         | status
-- Thales     | Luna Network  | 4          | 0    | absdb-master-key  | active

-- Generate a tenant DEK in the HSM
SELECT absdb_kms_generate_dek('tenant_acme', 'hsm');