Networking and private access

You decide who can reach each Plexivo Postgres, Plexivo MySQL and Plexivo Cache resource: anyone with its password over TLS, only your trusted networks, or nothing on the internet at all. Your own apps and the Plexivo CLI can still reach it.

Three ways to set it#

Apps and Plexivo Kubernetes workloads in the same project always reach the resource over the private network, whatever you choose. Apps in your other projects connect over the internet, like anyone else.

Change access#

1. Open the resource’s Network tab.
2. Choose. Under Access, pick Public, with TLS or Private.
3. Save. Review the change and choose Save network access.

The status beside Access reads Applying at the edge until the change is in force, then Open, TLS required, Trusted networks enforced or Private.

Trusted IP addresses#

With Public, with TLS, list the networks that may connect under Trusted networks. Enter an address such as 203.0.113.7 or a range such as 203.0.113.0/24, then choose Add. Add my IP adds the address you are using now.

• Addresses are IPv4 and on the public internet. Ranges run from /8 to /32. Private ranges such as 10.0.0.0/8 are refused.
• If you are on IPv6, add the IPv4 address your connection uses.
• An empty list lets every address try, and each must still present the password over TLS.

Each plan allows a number of trusted networks per resource: by default 5 on Developer, 10 on Startup, 20 on Business and 50 on Enterprise. The tab shows how many you have used.

curl -s -X PUT $API/deployments/$DB/network \
  -H "Authorization: Bearer $PLEXIVO_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"access": "public", "trusted_ips": ["203.0.113.7", "198.51.100.0/24"]}'

Use "access": "private" to make it private. GET on the same path shows the current access, its address, whether the change is in force, and your plan’s limit.

Reach a private database from your computer#

The Plexivo CLI opens an encrypted tunnel to any database or cache, public or private. Sign in with Operate or Full access, then:

plexivo db list
plexivo db connect orders-db

• The tunnel listens on 127.0.0.1, on the engine’s usual port: 5432 for Plexivo Postgres, 3306 for Plexivo MySQL, 6380 for Plexivo Cache. If that port is busy, it picks a free one. Choose your own with --port.
• The CLI prints the connection string. Keep it running and connect from a second terminal.
• The database’s own TLS and password still apply inside the tunnel.
• Each tunnel grant lasts an hour, and the CLI renews it for as long as the command runs and your sign-in is valid. Ctrl+C closes it.
• Every tunnel is recorded in your organisation’s activity log, with the address it came from.

Private Plexivo App Runner apps#

Apps can be private too, with no internet address and a list of the services allowed to call them. See Public and private apps.

Next steps#