Connections
Add and secure database connections, including TLS, SSH tunnels and read-only mode.
Connections are saved locally and encrypted at rest using Windows DPAPI, which ties the stored secret to your Windows account. Credentials are never transmitted anywhere except to the database server you are connecting to.
Connection manager
4 saved connections
Local development
localhost:3306
Staging
db-stage.internal:3306
Production (read-only)
db-prod.internal:3306
Analytics replica
db-replica:3306
- Host
- db-prod.internal
- Port
- 3306
- User
- schemasync_ro
- TLS
- Required · verify CA
- Timeout
- 30s
- Write access
- Blocked
Connected in 84 ms · MySQL 8.4.0
Required privileges
Use a read-only user for comparison and a separate, more privileged user for deployment. That separation is the single cheapest safety measure available to you.
| Task | Privileges needed |
|---|---|
| Compare schemas | SELECT on the schema, plus SHOW VIEW to read view definitions |
| Read routines and triggers | SELECT on INFORMATION_SCHEMA, and TRIGGER for trigger bodies |
| Apply a migration | ALTER, CREATE, DROP, INDEX and REFERENCES, as the plan requires |
| Back up with data | SELECT, plus LOCK TABLES for a consistent snapshot |
Encryption in transit
Set TLS to Required and enable certificate verification for anything that is not on your own machine. Supply the CA certificate when the server uses a private authority, which is the default for Amazon RDS and Azure Database for MySQL.
Reaching a private database
For instances that are not publicly reachable, use the SSH tunnel option rather than opening the database to the internet. SchemaSync opens the tunnel itself using password or private-key authentication and connects through it.