Connecting to Databases

Connections are server-held records bound to your user account, the browser never sees a credential or opens a socket to a database. This page covers the connection model, engine-specific parameters that actually matter (TLS posture, Oracle addressing, Mongo topology, server-side file access), and how connections move between the IDE and the DB DevOps Manager.

Ownership & Persistence

Connections are private to the creating user: you see only your own in the IDE, and they live on the server tied to your account, so they persist across sign-out and browser-cache clears. Passwords are encrypted at rest (AES-256-GCM) and are never returned to the client, on edit, the password field reads blank; leave it blank to retain the stored secret, or type a value to replace it. Administrators can see all connections through the DB DevOps Manager.

Lifecycle & Navigator State

Every saved connection is a root node in the navigator. A connected root shows its engine icon in full color and an expandable, introspected tree; a disconnected root is greyed and collapsed. Row-level (and right-click) actions: Connect (opens the pool and loads schema), Disconnect (tears down the pool and clears the tree), and Edit connection (re-validates before applying). Test before saving: the probe opens a socket, authenticates, runs a liveness statement appropriate to the engine, and returns the server version on success or the precise driver error on failure, connection refused, auth failure, unreachable host/timeout, and TLS-required are the usual distinct outcomes.

Engine-Specific Connection Notes

Beyond the standard host/database/credential fields, the connection form exposes the parameters that change behavior per engine. Defaults are engine-appropriate and pre-filled; the items below are the ones worth deliberate attention.

PostgreSQL / CockroachDB / TimescaleDB

• SSL mode, full spectrum from disable through require to verify-ca / verify-full. Managed Postgres (RDS, Cloud SQL, Azure) generally mandates at least require; use verify-full with the provider CA for MITM protection.
• Application name, propagated to pg_stat_activity so IDE sessions are attributable server-side.
• A full connection URI may be supplied in lieu of discrete fields. TimescaleDB and CockroachDB speak the Postgres wire protocol; TimescaleDB additionally surfaces hypertable metadata in the navigator.

MySQL / MariaDB

• Optional TLS and connection character set (utf8mb4 default). MariaDB is protocol-compatible; selecting it only adjusts dialect handling for MariaDB-specific SQL.

SQL Server

• Instance name for named instances; Encrypt (TLS) on by default with Trust Server Certificate for self-signed dev endpoints.
• Integrated/Windows auth requires the host process to sit in the same AD domain; otherwise use SQL Server authentication.

Oracle

• Address by Service Name (preferred) or SID, one or the other, not both.
• Connection type Basic (host/port/service) or TNS (a tnsnames.ora alias).
• Wallet location for wallet-based TLS (e.g. Oracle Cloud / ADB). Oracle schemas map to users, which the navigator reflects.

MongoDB

• Connect via a full URI (including mongodb+srv:// for Atlas) or discrete host fields, not both. Auth source, replica set, and TLS are exposed for real topologies rather than single-node assumptions.

SQLite

• The database path is resolved on the server filesystem, not the browser. In containerized deployments the file must be reachable inside the container via a volume mount. Read-only open is available for safe inspection of production copies.

Redis

• Optional AUTH secret, logical DB index selection, and TLS.

Importing from DB DevOps

The IDE and the DB DevOps Manager maintain independent connection registries. Use Import from DB DevOps (the + menu) to copy DevOps connections into the IDE as your own editable records, mutating or deleting the copy never touches the DevOps original. The picker excludes any target you already hold and de-dupes on import, so re-importing is idempotent. The inverse (IDE → DevOps) lives in the DevOps Connections view.

Organization

Folders are a per-browser presentation layer, they group connection roots (nestable, collapsible; unfoldered connections fall under "Ungrouped") without altering the server-side record. Typical segmentation is environment-first (Development / Staging / Production) with role annotations (primary vs. read replica) so read-only replicas are visually distinct from writable primaries.

Pooling & Tier Limits

Activating a connection establishes a server-side pool that is reused across queries and tabs and reaped after idle timeout, so tab switching costs nothing at the transport layer. Pool sizing and idle behavior are configurable via server env (see Configuration). Registry size is capped at 10 on Starter; Professional and Enterprise are unlimited.