Databases — EnclaveStack

Overview

A database keeps your app’s data on disk: PostgreSQL, MySQL, MongoDB or ClickHouse. EnclaveStack creates it with a strong owner password, kept as a secret your apps can use.

It answers to a private name in its network, and backs up to a bucket on a schedule when you add a backup.

When to use it

Users, orders, posts — data that must not be lost (PostgreSQL, MySQL).
Documents with a flexible shape (MongoDB).
Analytics over many rows (ClickHouse).

How it works

PostgreSQL 16 or 17: postgres:<version>-alpine, port 5432, health check pg_isready, 512 MiB by default.
MySQL 8.4: mysql:8.4, port 3306, 1024 MiB by default.
MongoDB 7.0 or 8.0: mongo:<version>, port 27017, 1024 MiB by default.
ClickHouse 25.8 or 26.3: clickhouse-server, HTTP 8123 and native 9000, 2048 MiB by default.
Data volume: The data directory is an engine volume that survives restarts, upgrades and moves.

Each database is one container from a pinned image, with its data on a volume and its owner password in a managed secret (<name>-password). Apps reach it as <name>.database.internal.

Backups take a logical dump with the engine’s own tool — pg_dump for PostgreSQL — and stream it into a bucket while computing its checksum.

Architecture

Apps reach the database by name with the password from its secret; backups stream to a bucket.

Flows

Creating a database

EnclaveStack generates the owner password and stores it encrypted as <name>-password.
It creates the data volume and starts the engine’s container.
It waits for the engine’s health check, then marks it Ready with its address.

Connecting from an app

Give the app the host <name>.database.internal and the password from the secret.
The app connects inside the network; nothing is exposed to the internet.

Set it up

In the console

Open Databases and choose New database.
Name it and choose the engine and version.
Choose Create; its page shows the address and the password’s secret.

With the CLI

enclave db create orders --wait

With OpenTofu

OpenTofu configuration

resource "enclave_database" "orders" {
  name    = "orders"
  engine  = "postgres"
  version = "16"
}

Settings reference

Every setting and output of the OpenTofu resource; the console and the CLI use the same names in their own words. Generated from platform 4d30582.

`enclave_database`
Name	Type	Use	What it does
`name`	text	required	Name of the database: 3–40 lowercase letters, digits or hyphens, starting with a letter. Changing it replaces the database.
`engine`	text	optional	postgres (default), mysql, mongodb or clickhouse. Changing it replaces the database (and its data).
`machine`	text	optional	The machine to run on (default: EnclaveStack chooses, and this reads back its choice). Changing it moves the resource, with its data, in place; apply waits for the move.
`machine_labels`	map of text	optional	Labels the machine must have, when machine isn't set (key=value, all must match).
`network`	text	optional	Network to place it in (default: the default network). Changes in place.
`project`	text	optional	The project to create it in. Defaults to the provider's project (ENCLAVE_PROJECT, else default). Changing it replaces the resource.
`subnet`	text	optional	Subnet of the network (default: its first).
`version`	text	optional	The engine's version (default the engine's own: postgres 16, mysql 8.4, mongodb 7.0, clickhouse 26.3). Changing it replaces the database (and its data).
`database_name`	text	output	Database name.
`engine_port_native`	number	output	ClickHouse's native-protocol port on this machine (port is its HTTP interface).
`host`	text	output	Host to connect to from this machine (none in a network without internet).
`id`	text	output	Resource ID.
`internal_host`	text	output	Host apps use on the EnclaveStack network.
`internal_port`	number	output	Port apps use on the EnclaveStack network.
`password_secret`	text	output	Name of the managed secret holding the owner password.
`port`	number	output	Port to connect to from this machine (none in a network without internet).
`private_dns`	text	output	Name it answers to inside its network: <name>.database.internal.
`private_ip`	text	output	Address in its network.
`username`	text	output	Owner user name.

Limits and security

Good to know

The engine and version can’t change after creation; create a new database and restore a backup into it.
Data lives on this machine; add a backup to keep a copy elsewhere.

Security

The password is generated, stored encrypted and never shown in logs or events.
Deleting asks you to type the name first; the data goes with it.