Skip to content
Documentation menu

Direct Connections

Connect cloud databases directly over TLS: when to use it, network protections, allow-listing and credentials.

A direct connection lets Prynt Cloud open the connection to your database itself, over the internet and always over TLS. It is meant for managed cloud databases that are already reachable from the internet in a protected way. Databases on a private network connect through the Prynt Gateway instead.

When to use a direct connection

Directcloud database
Managed Oracle or PostgreSQL in a public cloud, with a public DNS name, TLS and network rules you control. Nothing to install.
Gatewayprivate network
On-premises databases, private cloud networks, VPNs: the typical ERP. Outbound-only, credentials sealed for the gateway. Recommended whenever possible.

The mode is chosen per connection, so the same data source may use a gateway in one environment and a direct connection in another.

Configure the connection

Open the data source, choose Configure on an environment and pick Direct connection. Then enter:

  • Host: the public DNS name of the database. Private and local addresses are refused (see below).
  • Port: the listener port. Allowed ports are 1521–1526, 2483 and 2484 for Oracle; 5432–5435 and 6432 for PostgreSQL.
  • Service name (Oracle) or Database (PostgreSQL), User and Password of a read-only user.
  • TLS, and in Advanced the connect timeout (default 15 s), the query timeout of the database explorer and session setup (default 30 s; datasets have their own timeout) and the maximum pool size (default 20).

Save connection saves and tests it at once (permission sql.execute): you see the latency, the server version and the effective user, or the error, with warnings about TLS and privileges.

TLS

Direct connections must use TLS: a connection with TLS disabled is refused with DATA_SOURCE_TLS_REQUIRED. Choose the mode in the connection:

verify-fullrecommended
Encrypted; the server certificate must be signed by a trusted authority and match the host name. The default.
verify-camode
Encrypted; the certificate must be signed by a trusted authority, the host name is not checked.
requiremode
Encrypted, but the certificate is not verified: exposed to anyone impersonating the server. Prynt warns about it.

For Oracle, TLS means a TCPS listener. Prynt connects without a wallet: the server certificate must be trusted by the certificate store of the operating system that connects (for a direct connection, Prynt's servers: in practice, a certificate from a public authority). With verify-full the server's DN is matched too, and you may set the expected server certificate DN. Client certificates (mutual TLS) and wallets are not supported. For PostgreSQL the modes map to sslmode. See Oracle and PostgreSQL.

Network protections

Prynt checks every direct connection before opening it, so that a connection cannot be used to reach Prynt's own network or private addresses (server-side request forgery):

  • The host name is resolved and every address it resolves to is checked, not just the name. Private (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, fc00::/7), loopback, link-local, CGNAT (100.64.0.0/10), multicast, documentation and other reserved ranges are refused, and so are the platform's own networks. One refused address among several is enough to refuse the host.
  • The port must be one of the allowed ports of the database type.
  • Pooled connections are checked again every 60 seconds, so a DNS record changed to a private address afterwards (DNS rebinding) is caught.

A refused host is not a bug

DATA_SOURCE_HOST_NOT_ALLOWED means the database is on a private or special network. That is exactly the case of the Gateway: install one next to the database.

Allow-listing Prynt

A database exposed to the internet should accept connections only from known addresses. Prynt does not publish a list of fixed egress IP addresses yet. Until it does, you cannot restrict a cloud firewall to Prynt by address alone: either contact us about the egress address of your environment, or use the Gateway, which needs no inbound rule at all and works with the database kept private.

Credentials

  • The password is write-only: after saving you see Password stored with Replace; it is never sent back to a browser or returned by an API.
  • It is encrypted at rest with envelope encryption: AES-256-GCM with a data key per organization, itself wrapped by a master key (or by a key in Azure Key Vault). The encryption is bound to the organization and the secret, so a value cannot be moved to another record.
  • Every query runs read-only, with timeouts and row limits, and is audited. Use a dedicated read-only database user all the same: Prynt warns when the user can write or has administrative privileges.

Errors

DATA_SOURCE_HOST_NOT_ALLOWED422
The host resolves to a private, local or reserved address, or the port is not allowed for the database type. Use a gateway.
DATA_SOURCE_TLS_REQUIRED422
TLS is disabled. Choose verify-full (or verify-ca / require).
DATA_SOURCE_NOT_CONFIGURED422
The data source has no connection for the requested environment.
DATA_SOURCE_UNAVAILABLE503
Render API: the database cannot be reached right now (network, listener, credentials refused).