Skip to content

External Connections

By default, Appliku exposes each database's port on the server's public IP address using Docker port mapping (e.g., 8001:5432). This makes the database reachable from the internet, which is useful for remote administration tools, external services, or connecting from your local machine.

The Allow External Connections setting lets you disable this exposure. When turned off, the database port is no longer published on the host -- only containers on the same Docker network can reach it.

Note

External connections open the database port to all addresses. On an EC2 server or DigitalOcean droplet with the managed firewall, add a rule for the database port on the Firewall tab, and only your IP addresses can connect.

How It Works

Standalone databases run as Docker Compose services connected to an internal applications network. Your application containers connect through this network using the private connection URL (e.g., postgresql://user:pass@42-db-1:5432/dbname).

Cluster-deployed databases run as a Swarm stack on the cluster's proxy overlay network. The private connection URL points to the Swarm service DNS name (e.g., postgresql://user:pass@appliku_datastore_42_db:5432/dbname). When external connections are enabled, the published port is bound in host mode on the selected DB node only, not via the cluster's routing mesh — only that one node exposes the port publicly.

When Allow External Connections is enabled (the default): - The database port is mapped to the host's public IP (e.g., 0.0.0.0:8001 -> 5432). - Standalone: docker-compose port mapping on the DB server. - Cluster: long-form mode: host port on the DB-labeled node (no routing mesh). - Both the public and private connection URLs work. - The database is reachable from outside the server.

When Allow External Connections is disabled: - The published port is removed from the deployed compose / stack file. - Only the private connection URL works (internal applications network for standalone, proxy overlay for cluster). - The database is not reachable from outside the host. - Your application continues to work normally because it connects via the internal/overlay network.

Tip

Even when external connections are disabled, a cluster-deployed database still allocates its public port on the selected node. Toggling external connections back on does not require renegotiating the port number.

Toggling External Connections

From the Dashboard

  1. Open your application in the Appliku dashboard
  2. Go to Databases and click Manage on the database
  3. Find the External Connections toggle in the database settings table
  4. Switch it on or off
  5. Appliku will redeploy the database container with the updated configuration

From appliku.yml

Add allow_external_connections to your database configuration:

databases:
  db:
    type: postgresql_17
    allow_external_connections: false
  redis:
    type: redis_7
    allow_external_connections: true

When omitted, the default is true (external connections allowed).

When Creating a New Database

The "Add Database" form includes an Allow External Connections switch. It defaults to on. Uncheck it before creating if you want the database to be internal-only from the start.

Effect on Connection URLs

When external connections are disabled, the Connection Info section on the database page only shows the internal connection URL. The public connection URL is hidden because it would not work.

Setting Public URL shown Private URL shown
External connections on Yes Yes
External connections off No Yes

Your application's DATABASE_URL (or equivalent) environment variable uses the private connection URL by default, so toggling this setting does not affect your running application.

Restrictions

You cannot disable external connections in the following scenarios:

  • Cluster-mode applications with a database on a standalone server -- The application in the cluster can reach such a database only through the public URL. A database that is deployed in the same cluster can use the private URL, so this restriction does not apply to it.
  • Cross-server setups -- If the application and database are on different servers (server-mode), the application connects via the public URL. Disabling external connections would break the connection.
  • Something that Appliku saved still uses the external URL -- see below.

In all cases, the toggle is refused with an error message that explains why. The database page shows the message above the toggle.

What Must Change First

When you turn external connections off, the public port is closed. Before it does this, Appliku looks for saved settings that still use the external host and port of the database. If it finds one, it refuses the change and lists each item with what to do:

Item Message What to do
An environment variable of the application with the source From Database and the property connection_url Env var NAME of app APP uses the external URL. Change the property to private_connection_url, then redeploy the application.
The same, but the variable is set in appliku.yml Env var NAME of app APP is set in appliku.yml and uses the external URL. Change it in appliku.yml and redeploy the application.
A backup of this database in the Connection URL mode, or a Custom backup whose URL has the external host and port Backup #N uses the external URL. Change the backup to the Private Connection URL mode, or delete it.
A Custom backup of another database of the team, whose URL is the external URL of this database Backup #N of database NAME uses the external URL of this database. Change its URL, or delete it.
A backup of a single-server database that runs on another server Backup #N runs on server NAME. Move the backup to the database server, or delete it.
A database migration that is waiting or running, with this database as the source or the target Database migration #N is running and uses the external URL. Wait until it finishes.

Make the changes, then turn external connections off again. The messages never show the URL or the password.

Turning external connections on is not checked. This check applies to the toggle on the database page (and the API). Other tools outside Appliku that use the external URL, for example a database client on your computer, lose access when you turn external connections off.

Effect on Backups

A backup in the Connection URL mode connects through the public port, so it needs external connections. For a database with external connections disabled, use the Private Connection URL mode. For a single-server database, such a backup must run on the database server. See Backup Connection Modes.

Security Considerations

Disabling external connections is a simple way to reduce your database's attack surface. When disabled:

  • Port scans will not discover the database port
  • No firewall rules are needed to protect the database
  • Brute-force attacks against the database credentials are not possible from the network

For databases that only serve an application on the same server, disabling external connections is recommended if you do not need remote access.

If you need occasional remote access (e.g., for debugging), you can re-enable external connections temporarily, then disable them again when done.