Skip to main content

External Connections

By default, Appliku exposes each database's port on the server's public IP address using Docker port mapping (e.g., 8001:5432). This makes the database reachable from the internet, which is useful for remote administration tools, external services, or connecting from your local machine.

The Allow External Connections setting lets you disable this exposure. When turned off, the database port is no longer published on the host -- only containers on the same Docker network can reach it.

How It Works​

Standalone databases run as Docker Compose services connected to an internal applications network. Your application containers connect through this network using the private connection URL (e.g., postgresql://user:pass@42-db-1:5432/dbname).

Cluster-deployed databases run as a Swarm stack on the cluster's proxy overlay network. The private connection URL points to the Swarm service DNS name (e.g., postgresql://user:pass@appliku_datastore_42_db:5432/dbname). When external connections are enabled, the published port is bound in host mode on the selected DB node only, not via the cluster's routing mesh — only that one node exposes the port publicly.

When Allow External Connections is enabled (the default):

  • The database port is mapped to the host's public IP (e.g., 0.0.0.0:8001 -> 5432).
    • Standalone: docker-compose port mapping on the DB server.
    • Cluster: long-form mode: host port on the DB-labeled node (no routing mesh).
  • Both the public and private connection URLs work.
  • The database is reachable from outside the server.

When Allow External Connections is disabled:

  • The published port is removed from the deployed compose / stack file.
  • Only the private connection URL works (internal applications network for standalone, proxy overlay for cluster).
  • The database is not reachable from outside the host.
  • Your application continues to work normally because it connects via the internal/overlay network.
tip

Even when external connections are disabled, a cluster-deployed database still allocates its public port on the selected node. Toggling external connections back on does not require renegotiating the port number.

Toggling External Connections​

From the Dashboard​

  1. Open your application in the Appliku dashboard
  2. Go to Databases and click Manage on the database
  3. Find the External Connections toggle in the database settings table
  4. Switch it on or off
  5. Appliku will redeploy the database container with the updated configuration

From appliku.yml​

Add allow_external_connections to your database configuration:

databases:
  db:
    type: postgresql_17
    allow_external_connections: false
  redis:
    type: redis_7
    allow_external_connections: true

When omitted, the default is true (external connections allowed).

When Creating a New Database​

The "Add Database" form includes an Allow External Connections switch. It defaults to on. Uncheck it before creating if you want the database to be internal-only from the start.

Effect on Connection URLs​

When external connections are disabled, the Connection Info section on the database page only shows the internal connection URL. The public connection URL is hidden because it would not work.

SettingPublic URL shownPrivate URL shown
External connections onYesYes
External connections offNoYes

Your application's DATABASE_URL (or equivalent) environment variable uses the private connection URL by default, so toggling this setting does not affect your running application.

Restrictions​

You cannot disable external connections in the following scenarios:

  • Cluster-mode applications -- Applications deployed to a Docker Swarm cluster connect to databases via the public URL. Disabling external connections would break the connection. Appliku will show a validation error if you try.
  • Cross-server setups -- If the application and database are on different servers (server-mode), the application connects via the public URL. Disabling external connections would break the connection.

In both cases, the toggle will be rejected with an error message explaining why.

Effect on Backups​

warning

Appliku's built-in database backup feature connects to the database using the public connection URL. If you disable external connections, scheduled backups will fail because the backup process cannot reach the database port.

Before disabling external connections, either:

  • Pause or remove any active backup schedules for that database
  • Switch to an alternative backup strategy that runs inside the server (e.g., a cron job using docker exec)

Security Considerations​

Disabling external connections is a simple way to reduce your database's attack surface. When disabled:

  • Port scans will not discover the database port
  • No firewall rules are needed to protect the database
  • Brute-force attacks against the database credentials are not possible from the network

For databases that only serve an application on the same server, disabling external connections is recommended if you do not need remote access or Appliku's built-in backups.

If you need occasional remote access (e.g., for debugging), you can re-enable external connections temporarily, then disable them again when done.