Run a fleet

Check many databases with one command and read one aggregate report.

One config lists every target; one command checks them all and rolls the results into fleet-report.json/.md with per-target grades plus fleet-common vs target-specific findings.

The two files

Connection profiles live in the run config; the fleet file references them by name — never inline passwords:

# pgdba-run.toml
default = "prod"
[connections.prod]
dsn = "postgresql://u@prod-db:5432/app"
[connections.stage]
dsn = "postgresql://u@stage-db:5432/app"

# pgdba-fleet.toml
[fleet.targets.prod]
connection = "prod"
tags = ["env=prod"]

[fleet.targets.stage]
connection = "stage"
skip_heavy = true
level = "standard"

Running

pgdba fleet check                                  # ./pgdba-fleet.toml, reports to ./<target>/
pgdba fleet check --out-dir /var/lib/pgdba --jobs 4
pgdba fleet check --fail-on-drift new              # per-target baselines gate the run

Each target gets its own state directory (<out-dir>/<target>/): reports, baselines, audit journals, and history never mix. That is also where drift baselines live — pgdba baseline save --state-dir /var/lib/pgdba/prod accepts one target’s set, and --fail-on-drift composes per target with the fleet exit staying the worst per-target exit.

Reading the aggregate

Per-target rows: exit code, grade, severity counts, top findings, and a link to the full per-target report.
Fleet-common findings: present on strictly more than half of the reachable targets — fix these first, one change heals many databases. Ties and single-target fleets report everything as target-specific.
Broken targets: unreachable targets are recorded with a redacted error (exit 3) without aborting the rest; the fleet exit is the worst per-target exit.

Unreachable targets never abort the run, and --jobs N (default 1, sequential) bounds parallel connections — raise it only as far as your smallest target tolerates.