Database Access (Dev / Staging)

You reach the dev/staging databases through a small bastion over an SSH tunnel — they aren't exposed to the internet. Two steps: open a tunnel, then connect your tool to localhost.

Before you start (one-time)

Send your SSH public key (~/.ssh/id_ed25519.pub) to DevOps so it's added to the bastion. You connect to the bastion as the dev user.
Get your database username + password from DevOps. Keep it in your password manager.

Connect with `psql`

1. Open the tunnel (leave this terminal running — it looks frozen, that's normal):

ssh -N -L 15432:private-pg-shared-dev-do-user-13038265-0.d.db.ondigitalocean.com:25060 [email protected]

2. In another terminal, connect (fill in your user + password):

psql "postgresql://<db-user>:<password>@localhost:15432/anatomi-dev?sslmode=require"

That's it — you're on the anatomi-dev database.

Connect with a GUI (DBeaver / TablePlus / DataGrip)

Most tools tunnel for you — no terminal needed. Create a PostgreSQL connection:

Tab	Field	Value
SSH	Host	`139.59.48.8`
	User	`dev`
	Auth	your private key
Main	Host	`private-pg-shared-dev-do-user-13038265-0.d.db.ondigitalocean.com`
	Port	`25060`
	Database	`anatomi-dev`
	User / Password	from DevOps
	SSL mode	`require`

Enable the SSH tunnel (DBeaver: SSH tab → Use SSH Tunnel; TablePlus: Over SSH; DataGrip: SSH/SSL tab). The database Host must be the full private-… hostname.

Other databases

Same steps — just swap the host and database name:

Database	Env	Host (use in the tunnel / GUI)
`anatomi-dev`	dev	`private-pg-shared-dev-do-user-13038265-0.d.db.ondigitalocean.com`
`production-db`	dev	`private-db-code-quality-dev-do-user-13038265-0.g.db.ondigitalocean.com`
`anatomi-staging`	staging	`private-pg-shared-staging-do-user-13038265-0.d.db.ondigitalocean.com`

Port is always 25060, SSL is always require.

Access

Dev = full read/write. Staging = read-only. Need a staging write? Ask DevOps.

Troubleshooting

You see…	Do this
`Permission denied (publickey)` (to the bastion)	Your key isn't on the bastion yet — ping DevOps.
`administratively prohibited` / `open failed`	Use the exact `private-…` hostname + port `25060` (not an IP, not the public host).
`password authentication failed`	Wrong/rotated password — get the current one from DevOps.
Tunnel "hangs" with no output	That's correct — `-N` keeps it open silently. Connect in another terminal.

Dev clusters are shared

Dev is full-access, but these clusters host other apps and the BI dashboards' data too. A DROP or TRUNCATE on the wrong table hits everyone — double-check before you run it.