Managed MySQL is in beta

Almost every application that keeps state wants a SQL database beside it. From today that database can run on Bahriya: managed MySQL is in beta, deployed next to your containers and managed from the console.

Getting access

During the beta, MySQL is enabled per organisation. To turn it on for yours, open a ticket in the console under Support → Tickets and ask for MySQL to be enabled. Once it is, MySQL appears in your organisation's navigation and you can create your first instance straight away.

During the beta, MySQL is managed from the console only. MySQL support in the Reis CLI and the Terraform provider is built (you will find examples below), but it is not activated until MySQL moves out of beta.

We would like to hear how it works for you. Feedback, questions and anything that surprises you are all welcome on the same ticket.

The MySQL you already use

It is MySQL 8.4 LTS, unmodified. Your ORM, your migration tool and your client library connect the way they always have. Containers in the same project reach an instance at its handle on port 3306:

DATABASE_URL=mysql://orders-app:<password>@orders-db:3306/orders

Connecting to MySQL

Databases and users are configuration

Most managed databases hand you a server and a root password and leave the rest to you. On Bahriya you declare the databases you want and the user that owns each one:

databases:
  - name: orders
    username: orders-app
  - name: reporting
    username: reporting-ro

The platform creates them, generates every password and keeps the instance matching the list. Add an entry and the database appears on the running instance. Remove one and, after you confirm by typing the instance's handle, it is dropped. Schemas you create yourself over SQL are never touched.

Passwords never appear in a read. They live in your vault as platform-managed secrets attached to the instance's project, so a container can reference one like any other secret instead of copying it. Reveal or rotate a password when you need it; every reveal is recorded in the activity log. Databases and users

Pick your failure tolerance

Three tiers, one question: what happens when a node fails?

• Single: one node that recovers from its own disk.
• Replicated: a primary plus one or two asynchronous read replicas, with a separate read-only endpoint for read-heavy applications.
• Highly available: MySQL Group Replication across three or five members. A write is acknowledged only once a majority holds it, and a failed primary is replaced automatically.

CPU and memory come as a plan, from 0.5 vCPU / 1 GB to 8 vCPU / 32 GB per node, with 5 to 250 GB of storage that can grow at any time. An instance can run in several regions; each region holds its own independent copy. Tiers and replication

Backups are always on

There is no switch to turn MySQL backups off. Every database is dumped on a schedule you choose, and the binary log ships off the instance every 15 minutes. The instance's Backups tab in the console shows the recovery window for each region: the range of moments your data can be taken back to.

Restoring never overwrites your instance. Pick a second inside the window and the platform builds a new instance holding your databases exactly as they were, while the original keeps serving traffic. Make it a disposable staging copy to read data back from, or a new instance to keep. Backups and point-in-time recovery

Encryption at rest

Choose encryption when you create the instance. MySQL's own encryption covers every table, including tables created later, along with the redo, undo and binary logs, and your database users cannot opt a table out. For a second layer, the volume encryption add-on encrypts every disk of the instance. Keys are managed by the platform and kept in your vault, and you can rotate the master key whenever you like without disconnecting your applications. Encryption at rest

TLS, without the certificate chores

Turn on TLS and the platform issues the instance's certificate and keeps it in your vault. You choose how long each certificate lasts (1, 3, 5 or 10 years), and it is renewed automatically 30 days before it expires and applied without a restart. Renewals are always signed by the same certificate authority, so the CA file your clients saved keeps working. You only get a new CA when you ask for one.

Getting that CA file is a download: the instance's page links to its TLS bundle in your vault, where the CA certificate can be copied or downloaded. Once Reis support is activated after the beta, it is also one command:

reis tls_bundle:show orders-db-tls --ca > orders-db-ca.pem

Prefer your own certificate? Bring your own TLS bundle instead. TLS

Private by default, reachable when you need it

An instance is reachable only from its own project until you decide otherwise. External access requires TLS and an IP allowlist, both enforced rather than suggested, and gives the instance its own port at the platform edge, with custom hostnames if you want them. And when you just need to look at a table, phpMyAdmin runs over HTTPS for the hours you ask for, then switches itself off. External access · phpMyAdmin

Everywhere you automate, after the beta

Reis and Terraform support for MySQL is not activated until MySQL moves out of beta. When it is, an instance is a few lines of Terraform:

resource "bahriya_mysql" "orders" {
  handle        = "orders-db"
  name          = "Orders DB"
  tier          = "single"
  cpumillicores = 1000
  memorymb      = 2048
  storagegb     = 20
  activeregions = ["falkenstein-1"]
  project       = bahriya_project.app.id
  tlsenabled    = true
 
  databases = [
    { name = "orders", username = "orders-app" },
  ]
}

The same instance from the CLI is one command, reis mysql:create --databases orders:orders-app …, or one YAML file through reis apply. Terraform · Reis YAML · Reis flags

Pricing

MySQL is billed per node for the plan and storage you choose, with backups and the volume encryption add-on billed separately. The passwords and keys the platform keeps in your vault are billed like any vault item. See pricing for the current rates.

Start here

Open a ticket under Support → Tickets to enable MySQL for your organisation, then read the MySQL overview to create your first instance.