Database access & imports

Public TCP access

Public access is off until an operator configures it. Panel-host PostgreSQL, MySQL, MariaDB, Redis, Valkey, KeyDB, Dragonfly and MongoDB can use a dedicated Traefik TCP sidecar. An IP allowlist is mandatory, with at most 100 ranges and no /0. Uploaded-certificate TLS termination is optional and unavailable for MySQL/MariaDB. Node databases do not support public access.

Import an existing dump

• Database admins can upload resumable 8 MiB chunks. Operators can select an object in a backup destination.
• Supported formats: PostgreSQL custom/plain SQL, MySQL/MariaDB SQL, MongoDB archive and Redis-compatible RDB (Redis, Valkey, KeyDB, Dragonfly), optionally gzipped.
• A pre-import safety backup is created first, followed by a check that the panel can still authenticate to the database.
• Use the database page, databases public-access|import|imports in the CLI, or the SDK's importFile helper. MCP exposes state and history through read-only tools.

Backup policies and panel recovery

Per-database policies choose a cron schedule, local retention, remote retention and destination. Without a policy the default is a daily backup with 7 kept. Panel self-backup separately protects SQLite, the master key, .env and Traefik config with a recovery passphrase and off-site retention; configure it under Settings → Panel backup.