Skip to main content

Databases on BYOS

Every deployment on your server runs against its own PostgreSQL database. This page covers the two database choices specific to running on your own hardware: where PostgreSQL itself runs, and how to open direct read-only access to a deployment's database for BI tools and scripts.

Where PostgreSQL runs​

When you register a server, the dashboard asks "Where should the Odoo databases live?" There are two options, and the choice shapes the install command you run on the server.

On your server (default)​

The installer sets up a dedicated PostgreSQL instance on the server itself, alongside Docker and the agent. Each deployment gets its own database there, and backups, restores, and staging copies all work out of the box. This is the right choice for most servers: no extra infrastructure, no network hop between Odoo and its database.

External or managed PostgreSQL​

If you prefer a managed database service (Amazon RDS, Google Cloud SQL, Azure Database for PostgreSQL) or an existing PostgreSQL cluster of your own, select External / managed PostgreSQL when registering the server. The install command then includes SKYSIZE_PG_MODE=external, and the installer prompts for the connection details (host, port, user, password, SSL settings) directly on your server.

note

The database credentials are entered on your server and stay there. They are never sent to Skysize; the dashboard only shows which mode the server uses and the database host.

In external mode:

  • No local PostgreSQL is installed. All deployment databases are created on the external server.
  • The connection can use TLS. If your provider requires or offers TLS (most managed services do), the SSL settings you enter are passed through to every deployment, including the CA certificate when you provide one.
  • The database user needs to create roles and databases. The installer verifies at setup time that the user you provide has the CREATEROLE and CREATEDB privileges; each deployment still gets its own database and its own role.
  • Extensions must be available on the server. Extensions your modules rely on (for example vector) are enabled per database when the server offers them. On managed services, check the provider's list of supported extensions.

The PostgreSQL server must be reachable from your Skysize server (VPC peering, private networking, or an allowlisted public endpoint, depending on your provider), and its version must be one your Odoo version supports.

caution

Pick the database location when you first set up the server. Switching an existing server between local and external PostgreSQL is possible, but the deployment databases have to be migrated manually; contact support before attempting it.

Direct database access (read-only)​

You can open direct, read-only PostgreSQL access to a deployment's database, for BI tools (Metabase, Power BI, Grafana), reporting scripts, or ad-hoc SQL. Access is per branch, protected by TLS, and blocked until you explicitly allow the IP addresses that may connect.

This feature is available on your own servers only, and only to project administrators. It applies to servers running the default local PostgreSQL; if the server uses an external or managed database, manage access through your database provider instead.

Enabling access​

  1. Open the branch in the dashboard and find the Database access card.
  2. Click Create read-only access. This creates a dedicated read-only role on your server and shows its password once; copy it before dismissing the banner.
  3. Download the CA certificate from the same card. Connections require TLS, and the CA lets your client verify it is talking to your server.
  4. Add the IP addresses that may connect (see below). Until the allowlist has at least one entry, all external connections are blocked.

The card shows the full connection details: host, port (5432 by default), database name, and role. A typical connection string looks like:

postgresql://[email protected]:5432/mydb?sslmode=verify-full&sslrootcert=skysize-db-ca.crt

Use sslmode=verify-full with the downloaded CA certificate so the connection is both encrypted and authenticated.

note

If the dashboard reports that the database port is not published on your server yet (servers installed before this feature), it shows a one-line command to run on the server to publish it. Port 5432 must also be open in your cloud provider's firewall (AWS security group, GCP firewall rule, and so on). A blocked firewall makes connections hang with no error; an IP missing from the allowlist is rejected instantly.

The IP allowlist​

Every mutation of the allowlist is applied on your server first and only then saved, so what the dashboard shows is always what the server enforces. If the server is offline, the change is refused.

  • Add a single address (203.0.113.5) or a network range (203.0.113.0/24), with an optional label such as "Office VPN" or "Metabase Cloud".
  • Removing an entry blocks that network immediately.
  • Very large ranges are flagged with a warning badge, and 0.0.0.0/0 (the entire internet) with a stronger one. Prefer the narrowest range that covers your tools; BI SaaS vendors publish the egress addresses they connect from.

What the read-only role can do​

  • Read everything, change nothing. The role can SELECT from all tables in that branch's database, including tables created by future module installs. It cannot write, create objects, or reach other databases on the server.
  • Bounded resource usage. The role is capped at 10 concurrent connections, and long-running or idle-in-transaction queries are terminated automatically.
caution

Read-only queries still run on the same server as your Odoo instance. Heavy or constant querying can slow it down; for intensive reporting, run queries off-peak or replicate the data to your own system.

Rotating and removing​

  • Rotate password invalidates the current password immediately and shows a new one, once. Every connected tool needs the new password.
  • Remove access drops the read-only role and blocks all external connections to the branch's database again.

Passwords are generated by the platform (128-bit random) and stored encrypted; they cannot be chosen manually.

Security model​

  • Only the branch's own database is exposed, only to the allowlisted networks, only over TLS, and only to the dedicated read-only role. Everything else, including connection attempts from non-allowlisted addresses, is rejected before password authentication starts.
  • What you allowlist is up to you: the ranges you add, and the firewall of the machine and cloud account the server runs in, remain your responsibility, as with the rest of the BYOS security model.