Connect from your own computer
Switch on connections from outside to reach your own database from TablePlus, DBeaver or psql, at an address like db-7h3k2q.tanzahost.co, encrypted.
Updated 17 Oct 20264 min read
An own MySQL, MariaDB, PostgreSQL or Valkey can take connections from your own computer, so you can open it in a tool like TablePlus, DBeaver or psql. It's off until you switch it on, on the database's page. Then it gets an address of ours, like db-7h3k2q.tanzahost.co, and a port of its own. Only encrypted connections get through, and you can allow only your own addresses.
A shared MySQL can't be opened: it only takes connections from its project's apps. Add an own database to connect from your computer.
A project can hold only databases, with no app and no domain, if a database is all you need: on a new account, choose A database only under What are you building?.
Switch it on
Open the database from your project's Overview.
Under Connections from outside, switch on Allow connections from outside. It shows Switching on…, then On.
Copy the Host and Port, or the Connection address, which has the user and password in it.
The database must be running to switch it on. Only the account's owners and Developers can switch it on or off, or change who may connect, and each change is in the activity log. An older MariaDB may restart once, for a few seconds, the first time it's switched on.
If the page says Not set up yet, connections from outside aren't switched on for Tanzahost yet, and the switch can't be used.
What you connect with
| What it is | |
|---|---|
| Host | db- and 6 random letters and digits, like db-7h3k2q.tanzahost.co. We choose it, never a name you pick. |
| Port | A port between 30000 and 39999, the database's own. |
| User and password | The database's own, under Connect, or an extra user's. See Users and passwords. |
| Encryption | Required: turn on SSL/TLS in your tool. |
The Connection address looks like this, with the real password where the dots are:
mysql://db_duka:…@db-7h3k2q.tanzahost.co:31544/db_duka?ssl-mode=REQUIRED
postgres://db_duka:…@db-7h3k2q.tanzahost.co:31544/db_duka?sslmode=require
rediss://default:…@db-7h3k2q.tanzahost.co:31544The first is for MySQL and MariaDB, the second for PostgreSQL, the third for Valkey. With psql, for example:
psql "postgres://db_duka:…@db-7h3k2q.tanzahost.co:31544/db_duka?sslmode=require"A PostgreSQL from outside is reached directly, without connection pooling. Your apps keep using DATABASE_URL inside the project, which is pooled.
Encryption and the certificate
Only connections that ask for encryption reach the database. A tool that connects without SSL/TLS is stopped at the start, and shows: "This database takes only encrypted connections from outside: turn on SSL/TLS in your tool (for example sslmode=require)."
The encryption is the database's own, so everything after the start is encrypted between your tool and the database, the password included. Each database has a certificate of its own, made on its server, whose key never leaves it. No public authority signs it, so your tool may ask whether to trust it. The page shows its Certificate fingerprint (SHA-256): trust it if the fingerprints match.
Who may connect
With nothing listed, any address may try, and only the password lets it in. To allow only your own:
Under Who may connect, type your addresses or blocks in Allowed addresses, one a line, like
203.0.113.7or198.51.100.0/24.Choose Save the addresses.
You can list up to 20, IPv4 or IPv6. Private network addresses aren't accepted: they can't reach the database from outside. Empty the list and save to allow any address again.
Password guessing is slowed for everyone: at most 20 new connections at once from one address, then one every 3 seconds, and at most 100 connections open to one database. Every password we make is 32 random letters and digits.
Anyone can try to connect while it's on. Keep the password secret, allow only your own addresses if you can, and give a reporting tool a user that only reads.
Switch it off
Switch off Allow connections from outside. Within seconds, the port closes, and the connections open from outside end at once. Your apps aren't affected.
The address and port stay the database's. Switch it on again and a tool's saved connection works as before. When the database is deleted, they go with it.
Example: Asha's accountant
Asha's accountant reads duka's sales in DBeaver, from the office. Asha adds a user reports with Reads only to her MySQL, switches on Allow connections from outside, and puts the office's address, 203.0.113.7, under Allowed addresses. She sends the accountant the host, the port and the reports user's password. In DBeaver, the accountant turns on SSL, compares the certificate's fingerprint with the one on the page, and connects. Nobody else's address gets in, even with the password.
What isn't offered
A shared MySQL from outside.
A PostgreSQL from outside through connection pooling.
SSH and SFTP from your own computer. The terminal works in the browser.