Connecting
Each cluster has one endpoint, db.<cluster>.scuttle.scailabs.ai, port 3306. It always points at a healthy server; you never address individual servers.
TLS is required#
Plaintext connections are refused, and so is TLS below 1.2. The certificate is issued by a public CA for the endpoint name, so verification works with the system trust store — turn verification on; there is no ScaiLabs CA to install.
Connection strings#
| Stack | Connection string |
|---|---|
| CLI | mariadb --host=<endpoint> --ssl-verify-server-cert --user=<account> -p <database> |
| JDBC | jdbc:mariadb://<endpoint>:3306/<database>?sslMode=verify-full |
| Go | <account>:<password>@tcp(<endpoint>:3306)/<database>?tls=true |
| .NET | Server=<endpoint>;Port=3306;Database=<database>;User ID=<account>;Password=...;SslMode=VerifyFull |
| Python | mariadb.connect(host=..., ssl=True, ssl_verify_cert=True, ...) |
Node (mysql2) |
createPool({host, ssl: {rejectUnauthorized: true}, ...}) |
Use the physical names: account acme_shop_app, database acme_shop_orders. The console and GET .../databases/<name> show these strings filled in.
Pool settings#
Keep the pool small and let it reconnect. An account may hold 100 connections by default. Set a connection lifetime below eight hours, enable a validation query or keep-alive, and make sure the pool replaces a broken connection instead of failing the request.
Open connections at a steady pace rather than in bursts. One source address may open at most 300 new connections in 10 seconds; beyond that, new connections are refused for a moment (see Limitations). A pool that opens its minimum size on start-up is fine. Hundreds of short-lived processes that each open their own connection at once aren't.
Restricting where an account connects from#
An account can be limited to the networks it may connect from. A connection from anywhere else is refused as if the password were wrong.
| Family | What you can list |
|---|---|
| IPv4 | any network, e.g. 203.0.113.0/24, or a single address 203.0.113.7/32 |
| IPv6 | single addresses only, e.g. 2001:db8::7/128; ranges are refused because MariaDB cannot match them |
To find the address your application connects from, run this on that host:
1 2 | |
Each answer contains the entry to add, for example "allowed_networks_entry": "203.0.113.7/32".
?format=text returns just the address.
Dual-stack hosts need both entries. The endpoints answer over IPv4 and IPv6, and many hosts prefer IPv6. An account that lists only the IPv4 address refuses the same host when it connects over IPv6, and the other way round.