MySQL on your VPS, with fine-grained user control

Here's what it looks like in the panel

Real screenshots of the ArduMaker panel, not mockups.

MySQL with its own account and safe access

From Apps you install a MySQL database with its own account, ready for your application or to connect from outside.

• It creates the database and an account with privileges only on that database.
• The account requires TLS: an unencrypted connection is rejected.
• External access on its own port and only from the IPs you allow: 3306 isn't exposed.
• The connection string is ready to copy, and the password is shown only on demand.
• You see live which IPs are connecting.

Before you install it

Use it when

• The application is built for MySQL or MariaDB: WordPress, Laravel, PrestaShop, Magento and many PHP systems.
• You're migrating a system that already uses MySQL and don't want to rewrite queries.
• You need to connect from outside with TLS and only from the IPs you allow.

It's not the right fit if

• You're starting a new project with no preference: PostgreSQL usually gives you more for the same.
• You only need cache or queues: that's Redis.

How to check it's working

1. Connect with the client: mysql -h db-123.arducloud.com -P 61381 -u user -p --ssl-mode=REQUIRED app -e "select version();" — it asks for the password and returns the version.
2. Check the connection is encrypted: show session status like 'Ssl_version'; should say TLSv1.2 or TLSv1.3. The app account requires TLS: without it, it's rejected.
3. Look at your privileges: show grants; — all privileges on your database and none global. show databases; only shows yours.

Tips

• If your client is old and can't negotiate TLS, update it: the account doesn't accept unencrypted connections.
• Only allowed IPs get in from outside.
• From an app in the same VPS use 127.0.0.1 and not localhost: the account is created for that host.
• Importing a large dump is faster from the VPS terminal than from your machine.
• Set up the VPS backups before storing production data.

MySQL without the console

And root over SSH for everything else.

• Safe install: If you don't set the root password, a strong random one is generated.
• Service status: Running or not, version, port 3306, and how many databases and users.
• Clean database list: List them with the system ones hidden, create, drop, and see size in MB and table count.
• Users with origin control: Local only (the default), from any host, or from a subnet like 192.168.1.%.
• Clear permissions: ALL, SELECT, INSERT, UPDATE, DELETE, CREATE, DROP, INDEX, ALTER and more, per database or across all of them. You see every GRANT a user has.
• Changes apply instantly: Permissions take effect without running FLUSH PRIVILEGES.
• Tables and rows: List tables and read the latest rows (up to 1000) from the panel.
• Web manager: Editable data grid, read-only SQL console, EXPLAIN, CSV and Excel import and export. A modern alternative to phpMyAdmin.
• Port 3306 stays closed: To reach it from another VPS of yours you use an encrypted SSH tunnel, with no firewall rule or IP list to maintain. If you need to connect from outside, the optional external access uses its own port with TLS and only your IPs.
• Real root over SSH: mysql, mysqldump, my.cnf: the whole server is still yours. The panel covers the day-to-day.

From zero to a database for your app

1. Install MySQL: One click, with a strong root password.
2. Create the database: Named after your project.
3. Create the user: Local for your app, or with access from a specific subnet.
4. Grant permissions: Only the ones you need, applied instantly.
5. Connect from another VPS: With an SSH tunnel, the database shows up on the other server's localhost without opening 3306.

How it works under the hood, and what to watch for

What you should know before you start, no fine print.

• By default users are local only. Remote access is enabled deliberately and per user: from any host, or restricted to a subnet like 192.168.1.%.
• Even with remote access enabled, the advice is not to publish 3306: to let another VPS use the database there is the SSH tunnel between VPS, which puts it on the other server's localhost.
• Permissions apply instantly, no FLUSH PRIVILEGES. Each user's detail view shows all of their GRANTs together.
• If you don't set the root password at install time, a strong random one is generated and shown to you when it finishes.
• Usernames accept lowercase letters, numbers and underscores.
• Needs systemd and a Debian or Ubuntu base. Verified in production on Ubuntu 22.04 and compatible with 18.04, 20.04 and 24.04.
• It is not available on Ubuntu 26.04: that version ships MySQL 8.4, which by default blocks the mysql_native_password accounts the installer creates. Not on 16.04 either, because systemd 229 won't start on a host with cgroup v2.
• The web manager needs Ubuntu 22.04 or later, because its tunnel relies on sshd_config.d.
• The database is included in the VPS backup; if you want your own mysqldump with your own retention, you set it up as a scheduled task.
• Real root over SSH: the panel is a shortcut, not a cage. Anything it does with a button, you can also do by hand.

Or just ask Claude, ChatGPT or Cursor

Everything you see in the panel, your AI agent can do through the ArduMaker MCP server: with your authorization, within the scope you grant, and with every action audited. See what the MCP does

MySQL: frequently asked questions

Services that go well together

Everything runs on the same VPS and is managed from the same panel.

• Database manager: A web grid for PostgreSQL and MySQL: edit rows, run SQL and EXPLAIN, and import/export CSV and Excel over a private tunnel.
• PostgreSQL: Install PostgreSQL and manage databases, users and permissions without the command line.
• Automatic backups: A full live backup every week, the last 4 kept, and a final copy when you delete the VPS.

How it works under the hood

The technical documentation for what this page covers: what each tool does, what changes, how to verify it and which MCP tools operate it.

• MySQL: MySQL 8 or MariaDB databases on the VPS with their own TLS-only account, grants on its database only and IP-based external access.

All the documentation