psql to Cloud SQL

psql to Staging / Production (Cloud SQL) #

Admin only. Database credentials sit with Vivek and Preetam.

Developers get no database login on either environment. roles/viewer grants Cloud SQL metadata only — no cloudsql.instances.login.

If you need to read application data, use Grafana. It proxies read-only SQL through the monitoring role, needs no credentials of your own, and is gated by Cloudflare Access rather than GCP IAM:

cd grafana && ./query -s Kh5fT8-Vz "SELECT count(*) FROM accounts"   # staging

If you need something Grafana cannot answer, ask in #back-end and an admin will run it. The rest of this page is the admin procedure.

Connect over Cloudflare WARP, straight to the private IP.

# staging writer
psql "host=172.21.32.7 port=5432 dbname=funnelstory user=<you> sslmode=require"

# staging read replica — use this for anything analytical
psql "host=172.21.32.13 port=5432 dbname=funnelstory user=<you> sslmode=require"

# production writer
psql "host=172.20.32.5 port=5432 dbname=funnelstory user=<you> sslmode=require"

Then, first thing, every session:

SET ROLE dev_ro;

sslmode=require is not optional. Cloud SQL rejects an unencrypted connection.

Endpoints #

Staging Production
Instance funnelstory-staging funnelstory-production
Writer private IP 172.21.32.7 172.20.32.5
Replica instance funnelstory-staging-replica not created yet
Replica private IP 172.21.32.13 —
Database funnelstory funnelstory

The production read replica is created at cutover. A DMS-managed destination cannot have replicas until it is promoted, so production has one endpoint today and the writer serves every read.

Two other instances exist per environment and are usually not what you want: funnelstory-micro-<env> (database sample_db, staging at 172.21.32.9) and grafana-<env> (Grafana’s own metadata).

Network setup (once) #

Follow the VPN setup instructions, team name funnelstory.

Next: connect to WARP, then run the staging psql command at the top.