> ## Knowledge Base Index
> Fetch the complete knowledge base index at: https://help.hodi.host/sitemap.xml
> Use this file to discover available pages before exploring further.
> Pure-Markdown content can be obtained by appending a '.md' suffix to the content URLs listed in the sitemap (without the trailing slash).

# How do I connect to my MySQL or PostgreSQL database from outside?

By default, your MySQL and PostgreSQL databases only accept connections coming from your own hosting. A connection from your computer, from a BI tool or from another server is refused, whatever the password. This is deliberate: a database open to the whole Internet is one of the fastest ways to lose your data.

To connect from outside, you declare the IP address you will connect from. It takes about a minute, and the same list covers **both MySQL and PostgreSQL**.

||| **Access applies to your whole account.** An address declared here opens **every database on your account**, MySQL and PostgreSQL alike, to **all** of your database users. There is no per-database setting. A valid password is of course still required, but only declare addresses you control and trust, and remove the ones you no longer use.

---

## Declaring your IP address

1. In cPanel, under **Databases**, open **Remote Database Access**.
2. In **Add Access Host**, enter the **public IP address** of the machine that will connect.
3. Add a comment (*office*, *my laptop*, *Metabase server*) so you can recognise it later.
4. Click **Add Host**.

Access opens within seconds. Nothing else to configure and nothing to ask us for.

**An entry you did not add?** The list often already contains one or two addresses. They are your server's own, put there by cPanel so that the sites it hosts can reach their databases. That is normal and there is nothing to worry about. Leave them alone: removing them can break your own sites.

**Which IP address?** The public one, not the `192.168.x.x` or `10.x.x.x` your machine sees. Open [hodi.host/ip](https://hodi.host/ip) **from the machine that will be connecting**: the page shows the public address it presents to the Internet, in IPv4 and IPv6.

**A word of warning about home and office connections:** most are on a dynamic IP that changes from time to time, sometimes at every reboot of your router. The day your connection stops working for no apparent reason, check your IP first: it has probably changed, and you simply need to declare the new one.

You can declare a range with the `%` wildcard, for example `203.0.113.%` for a whole class C. Keep it as narrow as possible: every address in the range you declare can reach your databases.

---

## Connecting to MySQL

| Setting | Value |
| ---- |
| Host | your server's hostname, for example `run1.hodi.host` |
| Port | `3306` |
| Database | `myaccount_mydb` |
| User | `myaccount_myuser` |
| Password | the one you set in cPanel |

cPanel **prefixes** database and user names with your account name. A database you created as `mydb` is really called `myaccount_mydb`, and this full name is what you have to enter.

From a terminal:

```
mysql -h run1.hodi.host -P 3306 -u myaccount_myuser -p myaccount_mydb
```

---

## Connecting to PostgreSQL: encryption is required

This is the point that catches everyone out, so here it is up front: **PostgreSQL only accepts remote connections encrypted with TLS**. A client that connects in clear text is refused even when your IP address is correctly declared and your password is right.

The error looks like this, and the giveaway is at the very end of the line:

```
FATAL: no pg_hba.conf entry for host "203.0.113.10", user "myaccount_myuser",
database "myaccount_mydb", no encryption
```

`no encryption` means your client did not negotiate TLS. Turn it on and the connection goes through.

| Setting | Value |
| ---- |
| Host | your server's hostname, for example `run1.hodi.host` |
| Port | `5432` |
| Database | `myaccount_mydb` |
| User | `myaccount_myuser` |
| Password | the one you set in cPanel |
| SSL mode | `require`, ideally `verify-full` |

**Always connect using the server hostname, the one ending in `.hodi.host`.** Never an IP address, and never your own domain name. Our certificate is issued for that server name, so `verify-full`, the mode that actually checks you are talking to the right server, only works when your client connects by it. You will find it in cPanel, in the **Server Information** panel.

With `psql`:

```
psql "host=run1.hodi.host port=5432 dbname=myaccount_mydb user=myaccount_myuser sslmode=verify-full"
```

In a graphical client (DBeaver, pgAdmin, TablePlus, DataGrip), there is an **SSL** tab in the connection settings: tick *Use SSL* and choose `require` or `verify-full`.

From your code:

```
Node.js (pg)   ssl: { rejectUnauthorized: true }
Python         psycopg.connect(..., sslmode="verify-full")
PHP (PDO)      "pgsql:host=...;dbname=...;sslmode=verify-full"
```

One last thing worth knowing: your PostgreSQL user only ever reaches the databases of your own account, and only those it has been granted in cPanel.

---

## When you do not need any of this

An application **hosted with us** talks to its database locally, through `localhost`. It needs no remote access, and giving it some would only widen the surface for nothing.

Likewise, to import a dump, run a query or inspect a table now and then, **phpMyAdmin** and **phpPgAdmin** are available directly in cPanel with nothing to configure.

Remote access is for what those cannot do: your database client on your machine, a BI or reporting tool, a migration, an external application.

---

## Good practice

* Give database users a **long and unique** password, different from your cPanel password.
* Declare **one fixed IP** rather than a broad range whenever you can.
* **Remove** the hosts you no longer use. The list is easy to forget, and an old entry stays valid.
* Never put your database credentials in code sent to the browser.

---

## If it does not work

| What you see | What it usually means |
| ---- |
| Timeout, or connection refused | Your IP is not declared, or it has changed since you declared it |
| PostgreSQL: `no encryption` | Your client is not using SSL, see the section above |
| PostgreSQL: certificate verification failed | You are connecting by IP address instead of hostname |
| `password authentication failed` | The user name is missing the account prefix, `myaccount_myuser` |
| The database exists but you cannot see it | The user is not linked to that database in cPanel |

Still stuck? Open a ticket with the exact error message and the IP address you are connecting from, and we will look at it with you.