Deploy MySQL with flags

A managed MySQL instance lives inside a project and is reachable from any container in that project. For the concepts, see the MySQL overview.

For the YAML-mode equivalent, see Deploy MySQL with YAML.

Minimal create

reis mysql:create \
  --project my-project \
  --name "Orders DB" \
  --handle orders-db \
  --databases orders:orders-app \
  --regions falkenstein-1

That gets you a single-node instance on the smallest plan (0.5 vCPU / 1 GB) with 10 GB of storage and one database, orders, owned by the user orders-app. Run reis mysql:create with no flags for an interactive prompt.

--databases takes NAME:USERNAME and can be repeated.

Choosing a tier and plan

reis mysql:create \
  --project my-project \
  --name "Shop DB" \
  --handle shop-db \
  --tier replicated \
  --replicas 2 \
  --cpu 2000 \
  --memory 8192 \
  --storage 100 \
  --databases catalog:catalog-app \
  --databases reporting:reporting-ro \
  --config max_connections=500 \
  --config slow_query_log=true \
  --backup_schedule "0 3 * * *" \
  --regions falkenstein-1

• --tier is single, replicated or ha, and is fixed at creation.
• --replicas is 1 or 2 read replicas for replicated, 3 or 5 members for ha.
• --cpu (millicores) and --memory (MB) must be one of the published plan pairs (see the overview).
• --config KEY=value sets a supported mysqld setting and can be repeated.

Highly available, encrypted and externally reachable

reis mysql:create \
  --project my-project \
  --name "Ledger DB" \
  --handle ledger-db \
  --tier ha \
  --replicas 3 \
  --cpu 4000 \
  --memory 16384 \
  --storage 250 \
  --encryption \
  --tls \
  --tls_validity_years 1 \
  --external \
  --allowed_ips 198.51.100.0/24 \
  --databases ledger:ledger-app \
  --regions falkenstein-1

--encryption can only be set at creation, as can --volume_encryption, the separately billed add-on that also encrypts every disk of the instance. Both use platform-managed keys; see Encryption at rest. External access needs --tls and at least one --allowed_ips; the connection port is allocated by the platform and shown by reis mysql:show. With --tls and no --tls_bundle, the platform issues the server certificate; --tls_validity_years sets its lifetime (1, 3, 5 or 10, default 3). It is renewed automatically 30 days before it expires, always from the same CA — get that CA certificate once from the instance's <handle>-tls bundle in your vault and pass it to clients with --ssl-ca.

Listing and inspecting

reis mysql:list
reis mysql:show <instance-id>
reis mysql:show <instance-id> --output json

mysql:show lists the plan, derived node count, databases, external port and regions.

Updating

mysql:update changes only the flags you pass:

reis mysql:update <instance-id> --cpu 4000 --memory 16384     # move to another plan
reis mysql:update <instance-id> --storage 200                  # grow storage
reis mysql:update <instance-id> --phpmyadmin --phpmyadmin_ttl 4 --allowed_ips 198.51.100.7/32

--databases replaces the whole list. To add a database, pass every existing entry plus the new one:

reis mysql:update <instance-id> \
  --databases catalog:catalog-app \
  --databases reporting:reporting-ro \
  --databases audit:audit-app

A list that leaves an existing database out drops that database and its user, with all their data, in every region. Reis asks you to type the instance handle first; under --no-interaction it refuses unless you add --force.

Credentials

Passwords are generated by the platform and never shown by mysql:show. Reveal one, or rotate it:

reis mysql:credentials <instance-id>                                   # root
reis mysql:credentials <instance-id> --username orders-app             # a database user
reis mysql:credentials <instance-id> --username orders-app --rotate    # new password

Rotation updates the instance to use the new password; clients using the old one fail to connect until they are given it. Revealing and rotating are recorded in the activity log.

The passwords are kept in your vault as platform-managed secrets (<handle>-mysql-root, <handle>-mysql-<database>); reis mysql:show lists them under Managed vault items.

Rotating the encryption master key

On an instance with --encryption, rotate the master key of every server online:

reis mysql:rotate-key <instance-id>

The rotation is asynchronous; reis mysql:show reports its outcome under Last key rotation. See Encryption at rest.

The TLS CA certificate

With --tls and no --tls_bundle, save the CA certificate clients pass to --ssl-ca:

reis tls_bundle:show <handle>-tls --ca > orders-db-ca.pem

Renewals keep that CA. To get a new one, replace it; every client using the old file then fails to verify the server until it has the new one:

reis mysql:replace-ca <instance-id>

See Replacing the CA.

Backups

reis mysql:backups <instance-id>
reis mysql:backups <instance-id> --region falkenstein-1

Shows the point-in-time recovery window per region and the database dumps inside it. See Backups and point-in-time recovery.

Restoring to a point in time

# A staging copy of every database, as at 13:30:00 UTC
reis mysql:restore <instance-id> --region falkenstein-1 --time 2026-10-04T13:30:00Z
 
# A new instance to keep, holding one database
reis mysql:restore <instance-id> --region falkenstein-1 --time 2026-10-04T13:30:00Z \
  --kind instance --handle orders-restored --name "Orders restored" --database orders
 
# A staging copy you can reach from outside and through phpMyAdmin
reis mysql:restore <instance-id> --region falkenstein-1 --time 2026-10-04T13:30:00Z \
  --external --phpmyadmin --allowed-ips 203.0.113.0/24

The restore never changes the instance you restore from. It prints the new instance's id: follow its restore status with reis mysql:show <new-id> and use it once the status reads completed. See Restoring to a point in time.

Deleting

reis mysql:delete <instance-id>

Deleting an instance deletes its data. A running, suspended or errored instance can be deleted; one that is still provisioning cannot.

Related

• Deploy MySQL with YAML — YAML-mode equivalent
• Connecting to MySQL — endpoints and credentials