Add databases

Availability All editions — Community and up.

Requires the manage targets permission.

Tessera brokers PostgreSQL and MySQL. Users connect to a local port with their normal database client; the controller injects the real database login, audits queries, and can restrict a session to read-only.

Create a database target

1. Go to Databases → Add database.
2. Enter a name and host.
3. Choose the engine — PostgreSQL or MySQL. The port defaults to 5432 (PostgreSQL) or 3306 (MySQL).
4. Optionally set a default database name, a project and group.

Set the credential

Open Credentials and provide the database username and password. It’s encrypted at rest and never shown again — enter a new value to rotate it.

The login you store defines what the brokered session can do on the server. Give Tessera an account scoped to what your users should reach; the read-only policy is an extra guardrail, not a replacement for database-side permissions.

How users connect

From the desktop app or CLI, connecting opens a local port speaking the database’s wire protocol and prints a ready-to-paste command, for example:

psql "host=127.0.0.1 port=15432 dbname=app"

Any client — psql, mysql, or a GUI — connects to that local port; the controller completes the real handshake. For PostgreSQL you authenticate with any user and no password. For MySQL connect as the local user tessera with an empty password (other usernames are rejected):

mysql -u tessera -h 127.0.0.1 -P <port>

Query audit and read-only

Statements run through a brokered session are recorded in the audit log. A read-only grant makes the proxy reject write and DDL statements while letting reads through — see Read-only policies for what’s blocked and how to tune it.

Grant access

As with any target, a database is invisible until someone has a grant. Add grants under Access — see Access control.