PostgreSQL

Connection Settings

Name: My PostgreSQL DB
Type: PostgreSQL
Host: host.docker.internal  # or your server IP
Port: 5432                  # default PostgreSQL port
Database: myapp_production
Username: postgres
Password: your_password
SSL Mode: disable          # or require, verify-ca, verify-full

Docker Setup

Make sure you're using the PostgreSQL Dockerfile:

# apps/api/Dockerfile.postgres
RUN apk add --no-cache \
    sqlite-libs \
    postgresql-client

Connection String Format

Velld supports standard PostgreSQL connection strings:

postgresql://username:password@host:port/database?sslmode=disable

Backup Command

Velld uses pg_dump under the hood:

pg_dump -h host -p port -U username -d database -F c -f backup.dump

Options:

• -F c: Custom format (compressed, allows selective restore)
• -F p: Plain SQL format (human-readable)
• -F t: Tar format

Common Issues

Connection refused:

• Ensure PostgreSQL is accepting connections from Docker
• Update postgresql.conf: listen_addresses = '*'
• Update pg_hba.conf to allow connections from Docker network

Permission denied:

• User needs appropriate privileges:

  GRANT CONNECT ON DATABASE myapp_production TO backup_user;
  GRANT SELECT ON ALL TABLES IN SCHEMA public TO backup_user;

SSL errors:

• For local development, use sslmode=disable
• For production, use sslmode=require or higher
• Provide SSL certificates if using verify-ca or verify-full

Best Practices

1. Create a dedicated backup user:

   CREATE USER backup_user WITH PASSWORD 'secure_password';
   GRANT CONNECT ON DATABASE myapp_production TO backup_user;
   GRANT SELECT ON ALL TABLES IN SCHEMA public TO backup_user;
   GRANT SELECT ON ALL SEQUENCES IN SCHEMA public TO backup_user;
   ALTER DEFAULT PRIVILEGES IN SCHEMA public 
     GRANT SELECT ON TABLES TO backup_user;

2. Use read-only replicas for large databases to avoid impacting production

3. Test restores regularly:

   pg_restore -h localhost -U postgres -d test_db backup.dump

4. Monitor backup size - large databases may need custom retention policies

MySQL / MariaDB

Connection Settings

Name: My MySQL DB
Type: MySQL
Host: host.docker.internal  # or your server IP
Port: 3306                  # default MySQL port
Database: myapp_production
Username: root
Password: your_password

Docker Setup

Make sure you're using the MySQL Dockerfile:

# apps/api/Dockerfile.mysql
RUN apk add --no-cache \
    sqlite-libs \
    mysql-client

Connection String Format

mysql://username:password@host:port/database

Backup Command

Velld uses mysqldump:

mysqldump -h host -P port -u username -p database > backup.sql

Options:

• --single-transaction: For InnoDB tables (no locks)
• --routines: Include stored procedures and functions
• --triggers: Include triggers
• --events: Include scheduled events

Common Issues

Access denied:

• Ensure user has sufficient privileges:

  GRANT SELECT, LOCK TABLES, SHOW VIEW, EVENT, TRIGGER 
    ON myapp_production.* TO 'backup_user'@'%';
  FLUSH PRIVILEGES;

Max packet size errors:

• Increase max_allowed_packet in my.cnf:

  [mysqldump]
  max_allowed_packet=512M

Connection from Docker:

• Update bind-address in my.cnf:

  bind-address = 0.0.0.0

Best Practices

1. Create a dedicated backup user:

   CREATE USER 'backup_user'@'%' IDENTIFIED BY 'secure_password';
   GRANT SELECT, LOCK TABLES, SHOW VIEW, EVENT, TRIGGER 
     ON myapp_production.* TO 'backup_user'@'%';
   FLUSH PRIVILEGES;

2. Use --single-transaction for consistent backups without locks:

   mysqldump --single-transaction --routines --triggers myapp_production

3. Exclude large tables if needed:

   mysqldump myapp_production --ignore-table=myapp_production.logs

4. Test restores:

   mysql -u root -p test_db < backup.sql

MongoDB

Connection Settings

Name: My MongoDB
Type: MongoDB
Host: host.docker.internal  # or your server IP
Port: 27017                 # default MongoDB port
Database: myapp_production
Username: admin
Password: your_password
Auth Database: admin        # usually 'admin'

Docker Setup

Make sure you're using the MongoDB Dockerfile:

# apps/api/Dockerfile.mongo
RUN apk add --no-cache \
    sqlite-libs \
    mongodb-tools

Connection String Format

mongodb://username:password@host:port/database?authSource=admin

For MongoDB Atlas or replica sets:

mongodb+srv://username:password@cluster.mongodb.net/database

Backup Command

Velld uses mongodump:

mongodump --host=host --port=port \
          --username=user --password=pass \
          --db=database --archive=backup.archive --gzip

Options:

• --archive: Single archive file
• --gzip: Compress the archive
• --oplog: Include oplog for point-in-time recovery

Common Issues

Authentication failed:

• Ensure user has correct roles:

  use admin
  db.createUser({
    user: "backup_user",
    pwd: "secure_password",
    roles: [
      { role: "backup", db: "admin" },
      { role: "read", db: "myapp_production" }
    ]
  })

Connection timeout:

• Check MongoDB is listening on all interfaces:

  # mongod.conf
  net:
    bindIp: 0.0.0.0

SSL/TLS errors:

• Use connection string with SSL options:

  mongodb://user:pass@host:port/db?ssl=true&authSource=admin

Best Practices

1. Create a dedicated backup user:

   use admin
   db.createUser({
     user: "backup_user",
     pwd: "secure_password",
     roles: [
       { role: "backup", db: "admin" },
       { role: "read", db: "myapp_production" }
     ]
   })

2. Use --oplog for replica sets to ensure consistency:

   mongodump --oplog --archive=backup.archive --gzip

3. Backup specific collections if needed:

   mongodump --db=myapp --collection=users

4. Test restores:

   mongorestore --archive=backup.archive --gzip \
                --nsFrom='myapp_production.*' \
                --nsTo='test_db.*'

5. For large databases, consider backing up during off-peak hours

Password Authentication

The simplest method—just provide your SSH password:

SSH Host: bastion.example.com
SSH Port: 22
SSH Username: deploy
SSH Password: your_ssh_password

Private Key Authentication

More secure—uses your SSH private key:

SSH Host: bastion.example.com
SSH Port: 22
SSH Username: deploy
SSH Private Key: |
  -----BEGIN RSA PRIVATE KEY-----
  MIIEpAIBAAKCAQEA...
  -----END RSA PRIVATE KEY-----

How to get your private key:

# Display your private key
cat ~/.ssh/id_rsa

# Or generate a new one
ssh-keygen -t rsa -b 4096 -C "velld-backup"

Then copy the entire key (including -----BEGIN and -----END lines) into Velld.