Docs / Managed databases

Connect to a database

5 minute read

Managed databases have no public address. They accept connections only from your own servers and apps on the private network (172.30.0.0/16), only over TLS, and only with a password. This guide gets you from a new database to a working connection string for PostgreSQL, MySQL and Redis.

1. Find the connection details

Open Databases and pick your database, for example orders-db. The Host column shows its private address and port, such as 172.30.4.12:5432. Connection details also list the default user, the password (hidden until you click Show) and the CA certificate.

The same details are available from the CLI. Add --json if you want to read them from a script.

Terminal

simplicloud db show orders-db
# name      orders-db
# engine    PostgreSQL 16
# size      Standard · 1 vCPU · 2 GB · 50 GB
# host      172.30.4.12
# port      5432
# user      admin
# database  orders
simplicloud db ca orders-db > ~/simplicloud-ca.pem

There is nothing to open in a firewall. Any server or app in the same organisation can reach the database over the private network at no charge.

2. Connect to PostgreSQL

Use sslmode=verify-full with the CA certificate so the client checks it is talking to your database. sslmode=require also works if your library cannot load a CA file; plain connections are refused.

PostgreSQL

# connection string
DATABASE_URL="postgresql://admin:[email protected]:5432/orders?sslmode=verify-full&sslrootcert=/root/simplicloud-ca.pem"
# from a server
psql "$DATABASE_URL"
orders=> select version();

3. Connect to MySQL

MySQL 8.0 listens on port 3306. Pass --ssl-mode=VERIFY_IDENTITY and the CA file. Most drivers accept the same options in the URL.

MySQL

mysql -h 172.30.4.14 -P 3306 -u admin -p \
  --ssl-mode=VERIFY_IDENTITY --ssl-ca=/root/simplicloud-ca.pem shop
# connection string (Laravel, Prisma, SQLAlchemy and others)
DATABASE_URL="mysql://admin:[email protected]:3306/shop?ssl-mode=VERIFY_IDENTITY&ssl-ca=/root/simplicloud-ca.pem"

4. Connect to Redis

Redis 7 listens on port 6379 with TLS on. Use the rediss:// scheme (two s) and the password from the console.

Redis

redis-cli -h 172.30.4.13 -p 6379 --tls --cacert /root/simplicloud-ca.pem \
  --user default --pass PASSWORD ping
# PONG
REDIS_URL="rediss://default:[email protected]:6379/0"

5. Give the connection string to your app

Store the URL as an encrypted environment variable on the app, never in your repository. Apps already sit on the private network, so the same private host works there.