Database Access Configuration

DBConvert Streams connects to databases over TCP/IP. This page covers network configuration, user permissions, and managed database setup for each deployment scenario.

Deployment scenarios

Local installation

When DBConvert Streams and your database run on the same machine:

• Use 127.0.0.1 as the hostname in connection settings
• For PostgreSQL, verify pg_hba.conf includes an entry for 127.0.0.1/32
• For MySQL, default installations typically accept localhost connections

Cloud deployment

When DBConvert Streams runs on a remote server (DigitalOcean, AWS, GCP, etc.):

1. Identify your server's public IP address
2. Add this IP to your database's allowed connections list
3. Configure firewall rules to permit traffic on the database port

PostgreSQL configuration

1. Edit pg_hba.conf (typically /etc/postgresql/<version>/main/pg_hba.conf):

# Allow specific IP address
host    all     all     <your-server-ip>/32    scram-sha-256

# For local connections
host    all     all     127.0.0.1/32           scram-sha-256

2. Set listen_addresses in postgresql.conf (typically /etc/postgresql/<version>/main/postgresql.conf):

# Listen on all interfaces (default is 'localhost' which blocks external connections)
listen_addresses = '*'

3. Restart PostgreSQL:

sudo systemctl restart postgresql

PostgreSQL CDC requirements

CDC mode requires additional permissions. The replication user needs:

-- Grant replication privilege
ALTER USER your_user REPLICATION;

-- Create a publication for the tables you want to replicate
CREATE PUBLICATION dbconvert_pub FOR TABLE users, orders;

The wal_level must be set to logical in postgresql.conf:

wal_level = logical

MySQL / MariaDB configuration

1. Configure bind-address in the MySQL configuration file (/etc/mysql/my.cnf or /etc/mysql/mysql.conf.d/mysqld.cnf):

[mysqld]
# Listen on a specific IP (more secure)
bind-address = <your-server-ip>

# OR allow all interfaces (use only with proper firewall rules)
# bind-address = 0.0.0.0

2. Restart MySQL:

sudo systemctl restart mysql

3. Create a dedicated user and grant privileges:

-- MySQL 8.0+
CREATE USER 'dbconvert'@'<your-server-ip>' IDENTIFIED BY 'your_password';
GRANT SELECT, INSERT, UPDATE, DELETE, CREATE, ALTER, DROP, INDEX, REFERENCES
  ON your_database.* TO 'dbconvert'@'<your-server-ip>';
FLUSH PRIVILEGES;

MySQL CDC requirements

CDC mode requires the binary log enabled and a user with replication privileges:

GRANT REPLICATION SLAVE, REPLICATION CLIENT ON *.* TO 'dbconvert'@'<your-server-ip>';
FLUSH PRIVILEGES;

Verify binary logging is enabled in my.cnf:

[mysqld]
log-bin = mysql-bin
binlog_format = ROW
binlog_row_image = FULL

Managed database services

AWS RDS

1. Open the RDS console and select your database instance
2. Click the linked security group under Connectivity & security
3. Add an inbound rule allowing TCP traffic on the database port from your DBConvert Streams server IP
4. For CDC on RDS MySQL, enable automated backups and set binlog_format = ROW in the parameter group
5. For CDC on RDS PostgreSQL, set rds.logical_replication = 1 in the parameter group and reboot

AWS Aurora

Aurora clusters run inside a VPC and require additional networking setup for external access.

1. VPC networking

If DBConvert Streams runs outside the Aurora VPC:

• Ensure the VPC has an Internet Gateway attached
• In the Route Table for the Aurora subnets, add a route: destination 0.0.0.0/0 → target: your Internet Gateway
• Verify the Aurora cluster has Public accessibility enabled (RDS console → Modify → Connectivity)

2. Security group

1. Go to EC2 Console → Security Groups
2. Create or edit the security group attached to your Aurora cluster
3. Add an inbound rule:
   • Type: MySQL/Aurora (3306) or PostgreSQL (5432)
   • Source: your DBConvert Streams server IP (e.g., 203.0.113.10/32)

3. User setup

For Aurora MySQL:

CREATE USER 'dbconvert'@'%' IDENTIFIED BY 'your_password';
GRANT SELECT, INSERT, UPDATE, DELETE, CREATE, ALTER, DROP, INDEX, REFERENCES
  ON your_database.* TO 'dbconvert'@'%';
FLUSH PRIVILEGES;

For Aurora PostgreSQL:

CREATE USER dbconvert WITH PASSWORD 'your_password';
GRANT CONNECT ON DATABASE your_database TO dbconvert;
GRANT USAGE ON SCHEMA public TO dbconvert;
GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO dbconvert;

4. CDC on Aurora

• Aurora MySQL: enable automated backups and set binlog_format = ROW in the cluster parameter group. Grant replication privileges:

  GRANT REPLICATION SLAVE, REPLICATION CLIENT ON *.* TO 'dbconvert'@'%';
  

• Aurora PostgreSQL: set rds.logical_replication = 1 in the cluster parameter group and reboot. Grant replication privilege:

  ALTER USER dbconvert REPLICATION;
  

Google Cloud SQL

1. Open Cloud SQL in the GCP console and select your instance
2. Go to Connections > Networking > Authorized networks
3. Add your DBConvert Streams server IP
4. For CDC on Cloud SQL PostgreSQL, set cloudsql.logical_decoding = on in database flags

Azure Database

1. Open your Azure Database resource
2. Go to Networking (or Connection security)
3. Add your DBConvert Streams server IP under firewall rules
4. For CDC on Azure Database for PostgreSQL, set wal_level = logical in server parameters

DigitalOcean Managed Databases

1. Go to the Databases section in your control panel
2. Select your database cluster
3. Under Settings > Trusted Sources, add your DBConvert Streams server IP

SSL/TLS connections

For encrypted connections, configure SSL in the connection spec — see SSL Configuration for modes and examples.

Troubleshooting

Connection refused

• Verify the database is listening on the expected address (listen_addresses for PostgreSQL, bind-address for MySQL)
• Check firewall rules allow traffic on the database port
• Confirm the IP is whitelisted in managed database settings
• Try connecting with psql or mysql CLI from the same server to isolate the issue

Authentication failures

• Verify username and password
• For PostgreSQL, check pg_hba.conf has the correct authentication method for your IP
• For MySQL, verify the user is created with the correct host ('user'@'host')
• Review database logs for specific error messages

CDC not working

• PostgreSQL: verify wal_level = logical and the user has REPLICATION privilege
• MySQL: verify binlog_format = ROW and the user has REPLICATION SLAVE privilege
• Managed databases: check that the CDC-related parameter group settings are applied and the instance has been rebooted

Reference

Default ports

IP whitelist summary

Related docs

• Connections API Workflows — Connection creation, SSL, and SSH tunnel configuration
• Streams API Workflows — Stream configuration and CDC mode