QueryGlow

Database Connections

QueryGlow supports 6 databases with built-in SSH tunnels for secure remote access. All credentials are encrypted at rest using AES-256-GCM.

Supported Databases

PostgreSQL :5432
MySQL :3306
MariaDB :3306
SQLite file
CockroachDB :26257
TimescaleDB :5432

Which Method Should I Use?

Your SetupConnection MethodSSL?
Database on same server as QueryGlowlocalhostNo
Your own VPS (Hetzner, DigitalOcean, etc.)SSH TunnelNo (tunnel encrypts)
Cloud database (Supabase, RDS, Neon, etc.)Direct connectionYes (required)

Scenario 1: Database on Same Server

QueryGlow and your database are on the same machine. This is the simplest setup.

Connection Settings

Host: localhost
Port: 5432 (or 3306 for MySQL)
SSL: No
SSH Tunnel: Off

QueryGlow uses network_mode: host in production, so it can access localhost services directly.

Scenario 2: Your Own VPS (SSH Tunnel)Recommended

Your database is on a remote server you control. The database port is NOT exposed to the internet (correct security!). SSH Tunnel lets QueryGlow connect securely through your existing SSH access.

Why SSH Tunnel?

Your properly-secured VPS firewall should look like this:

22/tcp   ALLOW  # SSH - how you manage the server
80/tcp   ALLOW  # HTTP
443/tcp  ALLOW  # HTTPS
# Port 5432 is NOT listed = blocked ✓

SSH Tunnel "teleports" QueryGlow inside your server, where it can access the database on localhost.

How to Configure

  1. Open the New Connection dialog.
  2. Toggle "Connect via SSH Tunnel" ON.
  3. Enter your SSH details:
    • SSH Host: Your server's public IP (e.g., 168.119.x.x)
    • SSH Port: 22 (default)
    • SSH Username: Your server user (e.g., root, ubuntu, deploy)
    • SSH Private Key: Paste the full contents of your private key (must be without passphrase)
  4. Configure the database connection:

    Host: localhost or 127.0.0.1

    Port: 5432

    SSL: No (SSH encrypts the connection)

    Use localhost because you're "inside" the server through the tunnel.

⚠️ Passphrase-protected keys are not supported. QueryGlow connects programmatically without interactive input. Generate a passphrase-less key for QueryGlow:

ssh-keygen -t ed25519 -f ~/.ssh/queryglow_key -N ""
cat ~/.ssh/queryglow_key.pub >> ~/.ssh/authorized_keys
cat ~/.ssh/queryglow_key  # Copy this into QueryGlow

Scenario 3: Cloud Database (Direct + SSL)

Managed databases like Supabase, AWS RDS, Neon, or PlanetScale. You don't have SSH access—the provider manages security.

Connection Settings

Host: db.xxx.supabase.co
Port: 5432
SSL: Yes ✓
SSH Tunnel: Off

Get your host, username, and password from your provider's dashboard (Connection Details or Connection String section).

Supabase

Settings → Database → Connection string

Neon

Dashboard → Connection Details

PlanetScale

Connect → General → Copy credentials

AWS RDS

RDS Console → Connectivity & security

Environment Color Coding

Every connection has an Environment setting. This adds visual indicators to help prevent accidental changes to production data.

DevelopmentGreen accent — safe to experiment
StagingYellow accent — test before production
ProductionRed accent — visual warning to be careful

Tip: Combined with Safe Mode, these visual cues help prevent accidental DROP TABLE or mass DELETE operations.

SQLite Configuration

Security: Path Restriction

For security, SQLite database paths are restricted to the /app/data directory inside the container. This prevents path traversal attacks.

How to Use SQLite

  1. Copy your SQLite file to the QueryGlow data directory:
    cp /path/to/your.db ~/queryglow/data/
  2. In QueryGlow, connect using the container path:
    /app/data/your.db
  3. To create a new database, just specify a path that doesn't exist yet. QueryGlow will create it.

CockroachDB Tip

Connection timeout? If you see "Timeout acquiring a connection", change localhost to 127.0.0.1. This avoids IPv6/IPv4 mismatch issues.

Credential Security

  • ✓Encrypted at rest: Passwords and SSH keys are encrypted using AES-256-GCM before storage.
  • ✓Unique per installation: Encryption uses your SESSION_SECRET as the key.
  • ✓Tamper-proof: GCM mode detects if stored credentials have been modified.
Next: Query Editor & AI Assistant →