Databases

Installing an engine

Engines are installed per server. Add PostgreSQL, MySQL, Redis, or Memcached under Engines on a server's Databases page. A server runs at most one of each, and installing one again does nothing. Start, stop, and restart an engine from the same page, or restart it from the Services list on the server's Overview.

Databases and users

Create a database on an installed engine. Names use lowercase [a-z0-9_] and are unique per engine per server. Then create users. A user's grants cover only the databases you select.

• The server generates the password and Provisore stores it encrypted. You can reveal it once, after the create job succeeds. A second reveal returns nothing.
• If you lose it, rotate the user. Rotation sets a new password, which you can reveal once.
• You can change a user's grants later, across databases on the same server and engine.
• Dropping a database drops its users with it. You confirm by typing the database name.

Connecting from your application

Applications on the same server connect over localhost. Put the credentials in the site's environment file, which is versioned, encrypted, and left out of backups.

Each user has its own setting for where it may connect from: this server only, one of your team's private networks, or any address. Which addresses the engine listens on is a separate setting, and neither implies the other.

A new engine listens on the server's loopback address and stays there until you expose it. Exposing it adds one private-network address, never every interface, and opens the port on that network's interface only. Redis gets a password Provisore generates, because Redis authenticates only when one is set. Memcached cannot be exposed. It has no authentication, so it cannot tell one client on the network from another.

Only "any address" needs a port open on the public interface, and Provisore does not open it for you. Add a matching firewall rule, limited to a source address where you can.