Connect to Plexivo Postgres

Connect to Plexivo Postgres from any PostgreSQL driver, ORM or tool. Every connection is encrypted with TLS, and the database’s own certificate lets your client check it is talking to your database.

Connection details#

Open the database and choose the Connect tab.

• Connection string: choose Reveal to see it with the password, and Copy to copy it. Switch between Public · external backends and Private · apps in this project.
• Download CA certificate: save it as plexivo-postgres-ca.pem.
• Database name, Connection pooling and Port.

A revealed connection string looks like this:

postgresql://app:<password>@orders-db-3f9a1c.db.plexivo.app:31542/app?sslmode=verify-full&sslrootcert=plexivo-postgres-ca.pem

• The user and the database are both app.
• The public host ends in .db.plexivo.app, and each database has its own public port. Always use the port shown on the Connect tab.
• The private address, for apps in the same project, uses port 5432.

Connect from your app#

Give the connection string to your app as an environment variable, ideally from Plexivo Secrets, and keep it out of browsers and mobile apps. Reuse a connection pool rather than opening a connection for every request.

import pg from 'pg';
import { readFileSync } from 'node:fs';

const pool = new pg.Pool({
  connectionString: process.env.DATABASE_URL,
  ssl: { ca: readFileSync('plexivo-postgres-ca.pem', 'utf8') },
  max: 10
});

When you connect a Plexivo App Runner app or a Plexivo Kubernetes workload to the database in Plexivo, it receives these environment variables and is updated when they change:

Connect from your laptop#

The Plexivo CLI opens an encrypted tunnel to the database, whether it is public, limited to trusted networks or private:

plexivo auth login
plexivo db connect orders-db

It listens on 127.0.0.1:5432, or a free port if that one is taken, and prints the connection string to use after Connect with:. Add --show-password to include the password. Keep it running and connect psql, TablePlus or DBeaver to it in a second terminal. See Install the Plexivo CLI.

psql "postgresql://app@127.0.0.1:5432/app?sslmode=require"

TLS#

Plexivo Postgres refuses any connection without TLS. Each database has its own certificate authority, and its certificate carries its public host name, so sslmode=verify-full with the downloaded CA checks both the certificate and the host. The console’s connection string uses it once you choose Reveal.

Connection limits and the pooler#

Each size has its own number of connections for your app, shown on the create form and on the Settings tab. By default they are: Plexivo’s own monitoring and backups use separate, reserved connections, never yours.

On Business and Enterprise, by default, clients connect through a built-in PgBouncer pooler in transaction mode, at the same host and port. Many client connections then share a smaller number of database connections, and connections are held through a failover instead of dropped. The Connection pooling line on the Connect tab shows whether it is on and its limits.

Without the pooler, every client connection is a database connection, so keep your app’s pool below the limit. With several app instances, the limit is shared between them.

Rotate the password#

If the connection string was shared or leaked, choose Rotate password on the Connect tab. The old password stops working, open connections keep running, and apps you connected in Plexivo receive the new one. See Rotate the database password.

Next steps#