Managed database services are convenient and expensive, and they put your data under a provider that answers to its own jurisdiction. Running your own on an offshore VPS costs the price of the server, and the data sits where you put it. The catalog installs five engines in one click, with credentials generated for you.
What is available
- PostgreSQL and MySQL 8, the defaults for most application stacks
- MariaDB 11, wire-compatible with MySQL, community governed
- MongoDB 7 for document storage, single-node
- Redis 7 for cache, queues, sessions and pub-sub, with persistence on
Get it running
Decide where the database lives
The cheapest and safest option is the same VPS as the application that uses it, reached over the local interface with no port published. Use a separate server only when you actually need to.
Install the engine
Install your engine from the catalog. The root password is generated (20 characters) and shown in the panel; MySQL and MariaDB also arrive with an appdb database ready to use.
Lock the port down before you connect anything
If the database has to be reachable from another machine, restrict the port with the firewall to that machine’s address only. An open 5432, 3306, 27017 or 6379 is found by scanners, not by luck.
Create a user per application
Move the generated root password into your password manager, then create a limited user for each application with rights only on the database it needs. Keep root for administration.
Database ports are scanned continuously across the whole internet, and unprotected Redis and MongoDB instances are found and wiped within hours, often ransomed. Never leave the port open to the world. Bind it to localhost when the app is on the same server, or firewall it to a single source address when it is not.
Unlike the web apps in the catalog, database engines speak raw TCP, so there is no certificate and no onion address to hide behind. That is not an oversight: it means the network layer is entirely your responsibility. Encrypt the connection at the client where the engine supports it, and never send credentials across the open internet unprotected.
The Redis install keeps an append-only file so data survives a restart. If you are using it as a pure cache and would rather not persist anything, turn that off in your own configuration.
These are single-node installs, which is right for application backends, microservices and prototypes. A production system that cannot tolerate downtime needs replication and a tested restore, not one container. See manage your VPS from chat for on-demand backups.
Start now
Spin up an offshore VPS and install your engine from the catalog, or read the documentation.