Databases

Customer database servers are installed on the node by the driver (internal/agent/databases*.go); the panel's own Postgres is unrelated. Listeners are loopback-only until some user has remote hosts.

Model

• Names are <account>_<name> (account - becomes _); database <= 48, user <= 32 characters.
• Privileges (readonly / readwrite / admin) replace each other on databases.grant.set. MariaDB: SELECT / DML / ALL on `acct\_db`.* (underscore escaped; no GRANT OPTION). PostgreSQL: per database three NOLOGIN group roles <db>_own (owner; admin users are members and log in with SET ROLE, so what they create is owned by the group), <db>_rw, <db>_ro, plus default privileges for new tables.
• Passwords are generated (24 chars), returned once by create/reset, never stored, never in list/get. With store_in_vault the vault keeps it and databases.user.password.reveal returns it (audited). Supplied passwords: 12-128 chars, letters+digits, no quotes/backslash/space/backtick. Top-level password keys are redacted by the host audit.
• Remote access (databases.remote.set): IPv4/IPv6 addresses or IPv4 CIDR; %//0 and ranges wider than /16 admin-only. MariaDB: extra 'user'@'host' entries (CIDR becomes addr/netmask) + REQUIRE SSL; PostgreSQL: hostssl/host lines in rc-hba.d/<user>.conf (included from pg_hba.conf, PG 16+). The engine listens on 0.0.0.0 only while some user has remote hosts (restart on change). TLS uses a self-signed cert generated by the agent (ssl module cert later). The firewall rule belongs to the security module (not built): the plan warns about it.
• Limits: databases.count/users/valkey_instances/valkey_mb/remote_hosts Reserve/Release; databases.connections becomes MAX_USER_CONNECTIONS / role CONNECTION LIMIT (read from the plan by probing Reserve, see follow-ups); databases.size_mb is enforced by databases.db.stats (reserves growth; when refused the database's grants are forced read-only, restored when it fits again; status quota_exceeded).
• Dump/restore: databases.db.export writes .sql/.sql.gz into the account's home, databases.db.import reads it. All file access runs as the account via runuser (no symlink escape by a root agent). Import runs as an ephemeral user with rights on that database only (cannot CREATE USER / touch other DBs; verified).
• Valkey: rc-valkey@<account>_<name> from a template unit, User=<account>, Slice=rc-acct-<account>.slice, loopback port from a sequence + unix socket in ~/valkey/<name>/, user default off, ACL user with a sha256 hash (no clear password on disk), dangerous commands denied, maxmemory from the request (counted against databases.valkey_mb), MemoryMax = 2x+64M. An rc-agent ACL user (token only in /etc/rc-valkey) feeds stats.
• Desired state first, then apply (idempotent); databases.reconcile re-applies everything keeping passwords; accounts.deleted subscription removes everything of the account (durable, idempotent).

Verified in the lab (2026-10-09, Ubuntu 24.04: MariaDB 10.11, PostgreSQL 16, Valkey 7.2)

• Create db+user on both engines; connect from a second container over TLS with the generated password; wrong password refused; before remote.set the port is closed; with require_tls a non-TLS client is refused (both engines).
• databases.count limit 2: third create -> limit_exceeded; valkey instance limit likewise; connection limit 3: fourth concurrent session -> max_user_connections error.
• readonly user cannot INSERT; readwrite can, cannot CREATE; password reset invalidates the old one; vault reveal.
• Export -> drop table -> import restores rows on both engines (gz and plain), ephemeral roles gone; a dump with CREATE USER is refused; ../ paths refused.
• Size quota flips a PostgreSQL database read-only (an empty PG database is ~7 MB).
• Reconcile recreated a database and user dropped behind the panel's back; remote off closes the listener again; Valkey runs as the account in its slice, CONFIG is denied; account deletion removed DBs/users/roles via the event.

External (bring-your-own) servers — w6-04

• databases.server.create registers a MySQL/MariaDB, PostgreSQL, MongoDB, Redis/Valkey or ClickHouse server: host, port, tls (off | on = encrypted, certificate not checked | verify = checked, optionally against a pasted CA) and the admin login. It is TESTED ON SAVE through the account's node (databases.server.test agent op: version, encryption, latency); a failing test saves nothing. The admin password goes to the vault (server/<id>) and is never returned, logged, audited or put in an event; it reaches the client only in its environment (MYSQL_PWD, PGPASSWORD, an HTTP header, RESP AUTH), never argv or SQL (unit-tested).
• Plans: limits databases.servers_sql / _clickhouse / _redis / _mongodb (count; 0 = that kind is not allowed).
• Every existing action takes server_id (db.create, user.create, lists); the engine is the server's kind. Names keep the <account>_ prefix. Users on an external MySQL/MariaDB get host % unless remote.set restricts them. Per kind: MySQL/MariaDB (flavour auto-detected: MySQL 8 copies hashes as IDENTIFIED WITH plugin AS 0x..) and PostgreSQL (same <db>_own/_rw/_ro model; a newer server brings the matching PGDG pg_dump) support everything incl. export/import/size; ClickHouse (HTTP interface: databases, SQL users, GRANT on db.*, sizes) has no export/import; Redis/Valkey: a "database" is the key namespace <name>:*, users are ACL users, readonly = %R~; MongoDB: register + connectivity test only (management is a follow-up). The agent refuses loopback / link-local / metadata hosts and names resolving to them (use the built-in engine for this node).
• Deleting a server is refused while databases/users are registered on it; deleting an account forgets its servers (the servers themselves are never touched).
• databases.db.snippets: PHP, Node, Python, Go, Ruby, Java and .NET for every family, with a PASSWORD placeholder.

Built-in engines on demand (databases.engine.install)

mysql (Oracle 8.4 LTS apt repo; refused while MariaDB owns :3306), postgresql + version 14-18 (PGDG), clickhouse (vendor repo; loopback; the passwordless default user is removed, rc_admin credentials in /etc/rc-clickhouse/admin.json 0600), qdrant (pinned release + SHA-256, loopback, API key in /etc/rc-qdrant/env), ferretdb (v1.24 pinned, over the node's PostgreSQL: a FerretDB "database" is a PostgreSQL database + user, clients use the PostgreSQL login with authMechanism=PLAIN). Repos and download URLs are fixed in databases_engines.go; keys are fetched over https.

Database tool (Adminer) - w11-61, proven and ON by default in w11-85

databases.admin.open (one database + one of its users) -> a single-use ticket -> the editor gateway's isolated origin -> Adminer 6.1.1 (pinned in the version catalogue, sha256-checked) running as the ACCOUNT's own user in its slice with no network, behind a root-owned socket. PHP is the node's own php-cli (the web server install brings it; the first open adds the PostgreSQL driver through apt once). The login is ephemeral, has the chosen user's privilege only and is never shown, stored or audited. Sessions are listed on the database's "Database tool" tab with Close; a session ends with the panel session, after 30 minutes without use, at the end of its life (admin_tool_session_hours, 4) or when its link was never opened. Built-in MariaDB, MySQL and PostgreSQL databases only; opens in its own tab (not framed), not made for a phone. Setting admin_tool_enabled (default on) switches it off for the whole server and closes every open session at the next sweep. Proof, limits and the bugs the real sign-in found: docs/security/database-tool.md; the lab walk is lab/tests/database-tool.sh.

Follow-ups closed

import takes clean (drops everything first: MariaDB/MySQL drop+create keeping charset, PostgreSQL recreates public); size enforcement runs from the schedule databases.stats.run (15 min, one unreachable server does not stop the rest).

Next

UI (w6-08); panel reverse proxy for the admin tool; MongoDB management on external servers; Qdrant collections/keys per account; ClickHouse/Redis dump; pin repo key fingerprints; grace period for deletes (AC-18), clone/rename, maintenance ops, slow-query log; firewall rule via security.