Connecting to the database

Production API: https://asi-database-node-api.arybit.co.ke. This HTTPS address serves HTTP diagnostics; it is not a PostgreSQL or MySQL connection endpoint.

Obtain the actual VM SSH address, approved SSH key, pinned known-hosts file, database name and least-privilege user from the operator. Use existing private credentials; examples deliberately contain no passwords. The backend supports a database on loopback. Do not expose ports 5432 or 3306 to the internet.

PostgreSQL on the VM

Run a PostgreSQL client on the database VM. Replace the name and user with provisioned values:

psql --host=127.0.0.1 --port=5432 --dbname=YOUR_DB_NAME --username=YOUR_DB_USER --password

Enter the password at the prompt, then verify:

SELECT current_database(), current_user;
SELECT 1;

PostgreSQL through SSH

On your workstation, keep this tunnel running in a separate terminal. Replace VM_ADDRESS with the verified VM SSH host; it may differ from the public API DNS target:

ssh -N -o ExitOnForwardFailure=yes -o StrictHostKeyChecking=yes -o UserKnownHostsFile=.private/production-known_hosts -i .private/production-admin.pem -L 127.0.0.1:15432:127.0.0.1:5432 azureuser@VM_ADDRESS

Then connect locally:

psql --host=127.0.0.1 --port=15432 --dbname=YOUR_DB_NAME --username=YOUR_DB_USER --password

For pgAdmin or DBeaver, use host 127.0.0.1, port 15432, the provisioned database/user and a privately entered password while the SSH tunnel is active. Encryption across the remote network is supplied by SSH. Never disable host-key verification to resolve a connection failure.

MySQL

The diagnostic driver supports an existing local MySQL instance. This does not qualify the disabled legacy SQL migrations.

mysql --host=127.0.0.1 --port=3306 --user=YOUR_DB_USER --password YOUR_DB_NAME

For workstation access, tunnel a different local port:

ssh -N -o ExitOnForwardFailure=yes -o StrictHostKeyChecking=yes -o UserKnownHostsFile=.private/production-known_hosts -i .private/production-admin.pem -L 127.0.0.1:13306:127.0.0.1:3306 azureuser@VM_ADDRESS
mysql --host=127.0.0.1 --port=13306 --user=YOUR_DB_USER --password YOUR_DB_NAME

Use DB_ENGINE=mysql and DB_PORT=3306 in the protected backend runtime settings for an existing MySQL deployment.

Application and migration identities

The API uses DB_ENGINE, DB_HOST, DB_PORT, DB_NAME, DB_USER and DB_PASSWORD. Supply these through the protected runtime file, never through browser configuration. Its readiness probe runs SELECT 1 only. Use separate identities for migrations and backups. PostgreSQL tenant policies use CURRENT_USER and asi.tenants.database_role; successful login alone does not grant tenant data access. Provision roles and grants deliberately and validate isolation before enabling products.

For authentication failures, confirm the database/user, password and server authentication policy. For connection refusal, confirm the service, tunnel and selected port. A 503 from /ready can reflect missing credentials or a failed probe. See qualification.