# Is it possible to automate the steps to enable pg\_tde for all new databases?

**URL:** <https://forums.percona.com/t/is-it-possible-to-automate-the-steps-to-enable-pg-tde-for-all-new-databases/38236>\
**Category:** PG\_TDE – Transparent Data Encryption (TDE)\
**Created:** [June 7, 2025, 9:04pm UTC](https://forums.percona.com/t/is-it-possible-to-automate-the-steps-to-enable-pg-tde-for-all-new-databases/38236 "2025-06-07T21:04:12Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Robinyo](https://avatars.discourse-cdn.com/v4/letter/r/dec6dc/32.png) [@Robinyo](https://forums.percona.com/u/Robinyo)\
**Post date:** [June 7, 2025, 9:04pm UTC](https://forums.percona.com/t/is-it-possible-to-automate-the-steps-to-enable-pg-tde-for-all-new-databases/38236/1 "2025-06-07T21:04:12Z")

</div>

Something like:

```auto
BEGIN;

\c template1
CREATE EXTENSION pg_tde;

SELECT pg_tde_add_database_key_provider_file('file-vault', '/tmp/pg_tde_test_001_basic.per');

SELECT pg_tde_set_key_using_database_key_provider('test-db-key', 'file-vault');

COMMIT;

```

For example via `docker-entrypoint-initdb.d`

I have a tried but see the following error:

```auto
FATAL: pg_tde can only be loaded at server startup. Restart required.

```

Also see:

- Sample [docker-compose.xml](https://github.com/Robinyo/hapi-fhir-au/blob/main/backend/docker-compose-apisix.yml)
- [Secure HAPI FHIR data at rest](https://rob-ferguson.me/secure-hapi-fhir-data-at-rest/)

---

<div class="post-metadata">

**Author:** ![Robert\_Bernier](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/robert_bernier/32/1367_2.png) [@Robert\_Bernier](https://forums.percona.com/u/Robert_Bernier)\
**Post date:** [June 9, 2025, 1:48pm UTC](https://forums.percona.com/t/is-it-possible-to-automate-the-steps-to-enable-pg-tde-for-all-new-databases/38236/2 "2025-06-09T13:48:37Z")

</div>

Hi,

You’re in luck! We just had an internal Lunch & Learn reviewing the current state of pg\_tde.

In order to enable a “global” and automated method of encrypting tables …

- Install & enable the extension which I assume you’ve already accomplished
- create a template database where you create the extension in this database

```auto
# postgresql.conf, server restart required
shared_preload_libraries = pg_tde

```

```auto
create database my_template
\c my_template
create extension pg_tde

```

Assuming you choose the key provider to be a local file, which is great for learning but discouraged for production environments, execute the following commands in your template database:

```auto
select pg_tde_add_global_key_provider_file('my_provider','/var/lib/postgresql/my_key.file' );
select pg_tde_set_default_principal_key('my_provider','provider_global','true';

```

And now you’re ready. From here on all you need to do is create your tables specifying the tde access method in any of your databases and they are encrypted.

Create your working database:

```auto
create db01 with template my_template;
\c db01
create table t1(id serial, comments text) using tde_heap;

```

So long as you create new databases using the user-defined template database everything is pretty simple.

Of course there’s far more to it since the API is pretty extensive but this should get you started.

Hope this helps