What this means
What this means
External access is off by default, because your app connects from inside CM Cloud and does not need it. Turning it on publishes your database on a TLS-only endpoint so you can connect from your laptop.
Before you start
Before you start
Decide whether you want this on. Your own client has full read and write access — unlike the console in the dashboard, which is read-only. Anyone holding these credentials can change or delete your data.
Step-by-step guidance
Step-by-step guidance
- Open the Connection tab and turn on Allow connections from outside CM Cloud.
- Select Show connection details and copy the host, port, database, user and password.
- In TablePlus or DBeaver, create a PostgreSQL connection and paste those values. Set SSL mode to Require or Verify Full.
- For the terminal, copy the psql command shown on the same tab.
- Turn external access back off when you no longer need it.
What CM Cloud support will review
What CM Cloud support will review
Support can confirm the endpoint is reachable and that TLS is being negotiated, but cannot see or reset your client's own configuration.
What is not automated yet
What is not automated yet
Plain connections are refused — TLS is required, and a client set to disable SSL will fail. Your client may list a database named postgres alongside your own; it cannot be opened, and that is expected. Connections you make this way do not appear in the access log, which records dashboard activity only.
Safety note
Safety note
The public endpoint is off until you turn it on, and refuses any connection that is not encrypted. Turn it off again from the Connection tab when you no longer need it.
Safe next action
Safe next action
Turn on external access, connect once with your tool to confirm it works, and decide whether to leave it on.