Connect to a private database

Get Astro's egress IPs

All agent workloads egress through the following static Elastic IPs. These are fixed and do not change unless we announce it:

Allowlist the IPs in your network

Add each IP to the inbound rules of whatever controls access to your database:

Use the port your database listens on. Common defaults: PostgreSQL 5432, MySQL 3306, MSSQL 1433, MongoDB 27017, Redis 6379. Check your database’s documentation if you’re unsure.

Declare the connection string in astropods.yml

Use inputs with secret: true so credentials are stored encrypted and never logged. The example below uses PostgreSQL; adjust the variable names and connection logic to match your database:

1
spec: blueprint/v1
2
name: my-agent
3
4
meta:
5
  visibility: private
6
7
agent:
8
  build:
9
    context: .
10
    dockerfile: Dockerfile
11
  inputs:
12
    - name: DATABASE_URL
13
      datatype: string
14
      secret: true
15
      description: Connection string for your private database

At deploy time, ast configure will prompt for the value. For PostgreSQL this looks like:

postgresql://user:password@your-db-host.internal:5432/mydb?sslmode=require

The format and client library will differ for other databases; refer to your database driver’s documentation. In your agent code, read the value from the environment:

1
import os
2
import psycopg2  # replace with your database driver
3
4
conn = psycopg2.connect(os.environ["DATABASE_URL"])

1
import { Pool } from "pg"; // replace with your database driver
2
3
const pool = new Pool({ connectionString: process.env.DATABASE_URL });

Create an internal NLB targeting your database

In your AWS VPC, create an internal Network Load Balancer (NLB) that targets your database instance on its port. If your database is already behind a load balancer, you can skip this step.

Create a VPC Endpoint Service

Create a VPC Endpoint Service pointing to the NLB. In the AWS Console go to VPC → Endpoint Services → Create endpoint service, select your NLB, and note the generated service name, which looks like:

com.amazonaws.vpce.us-east-1.vpce-svc-xxxxxxxxxxxxxxxxx

Contact Astro to establish the connection

Email support@astropods.com with the following:

We’ll authorize your account and create an Interface VPC Endpoint on our side.

Use the endpoint hostname in your connection string

Once Astro confirms the connection is live, we’ll send you a private DNS hostname for the endpoint. Use that as your database host in DATABASE_URL, then follow step 3 from Option 1 above to declare it in astropods.yml.