Best Practices

OpenSearch is an open-source search and analytics suite which serves as a centralized location to manage logs forwarded from other resources, such as databases and Droplets.

Use VPCs

We recommend you make full use of your DigitalOcean VPC networks to improve security, facilitate connection management, and mitigate trusted source limits. To do this, add the CIDR address of a database’s VPC network to its trusted sources. This functionally adds all other resources you have in the same VPC network to the database’s trusted sources using only one address towards the limit, as long as they connect via the private connection string, instead of the public one. The CIDR address also only counts as one trusted source IP against the 100-IP limit.

To add database’s VPC network CIDR to its trusted sources, go to the control panel and click on your database. In the Overview tab, find the VPC Network section, which details the VPC’s name (such as default-nyc3) and its address (such as 10.108.0.0/20). Copy the VPC’s address without its netmask to your clipboard. For example, instead of copying 10.108.0.0/20, copy 10.108.0.0.

Then, click the Settings tab. Find the Trusted Sources section and click Edit to the right of it. Paste the VPC’s address without the netmask and press Enter. Click Save to confirm your change.

Warning

You currently cannot add IPv6 rules to a database cluster’s trusted sources.

Once you’ve added the CIDR, all other resources in the database’s VPC network can connect to the database by using its private connection string, instead of the public one. You can find the private connection string in the database’s Overview tab in the Connection Details section.

For improved security, we recommend you use this private connection string whenever possible and minimize the number of public connections to the database.

To establish secure, centralized connections between resources in different VPCs or platforms, you can use a proxy server, for example ProxySQL or HAProxy.