Add a PostgreSQL server as a monitored device using the built-in pg_monitor role.
PostgreSQL 10+ ships a built-in pg_monitor role that grants exactly the read access needed for monitoring, no need to hand-pick individual privileges.
CREATE ROLE zynty_ro WITH LOGIN PASSWORD 'STRONG_PASSWORD'; GRANT pg_monitor TO zynty_ro;
Add an entry scoped to your collector's IP, and require an encrypted connection.
hostssl all zynty_ro 10.20.0.50/32 scram-sha-256
Configuration changes to pg_hba.conf need a reload (not a full restart) to take effect.
SELECT pg_reload_conf();
Choose PostgreSQL as the type and enter connection details. Enable Require TLS connection to match the encrypted access rule you just configured.