Connection security

Environment variables

Using environment variables

Reference environment variables in connection strings:

1
adapters:
2
  production_db:
3
    connector: postgres
4
    connection_string: '{{ env.DATABASE_URL }}'

Or construct from multiple variables:

1
adapters:
2
  production_db:
3
    connector: postgres
4
    connection_string: 'postgresql://{{ env.DB_USER }}:{{ env.DB_PASS }}@{{ env.DB_HOST }}:5432/{{ env.DB_NAME }}'

Setting environment variables

Local development:

export DATABASE_URL="postgresql://dev:dev@localhost:5432/myapp"
hyperterse dev -f config.terse

Using .env files:

Hyperterse automatically loads .env files from the current directory when starting:

DATABASE_URL=postgresql://dev:dev@localhost:5432/myapp

# No need to source - .env is loaded automatically
hyperterse -f config.terse

In Docker:

1
ENV DATABASE_URL=postgresql://user:pass@db:5432/app

SSL/TLS connections

We recommend ensuring all production connections are encrypted.

PostgreSQL

1
adapters:
2
  production_db:
3
    connector: postgres
4
    connection_string: 'postgresql://user:pass@host:5432/db?sslmode=require'

SSL modes:

Mode	Description	Use Case
`disable`	No SSL	Non-production only
`require`	SSL required, no verification	Cloud databases
`verify-ca`	Verify CA certificate	High security
`verify-full`	Verify CA and hostname	Highest security

MySQL

1
adapters:
2
  production_db:
3
    connector: mysql
4
    connection_string: 'user:pass@tcp(host:3306)/db?tls=true'

Redis

Use rediss:// for TLS:

1
adapters:
2
  cache:
3
    connector: redis
4
    connection_string: 'rediss://:password@host:6379/0'

Least privilege access

Create database users with minimal permissions:

PostgreSQL

1
-- Create read-only user
2
CREATE USER hyperterse WITH PASSWORD 'secure_password';
3

4
-- Grant only SELECT on specific tables
5
GRANT SELECT ON users, products, orders TO hyperterse;
6

7
-- For new tables
8
ALTER DEFAULT PRIVILEGES IN SCHEMA public
9
  GRANT SELECT ON TABLES TO hyperterse;

MySQL

1
-- Read-only access
2
CREATE USER 'hyperterse'@'%' IDENTIFIED BY 'secure_password';
3
GRANT SELECT ON myapp.* TO 'hyperterse'@'%';

Network security

Private networks

Keep databases on private networks:

1
┌─────────────────────────────────────────────────────┐
2
│                    Private VPC                      │
3
│                                                     │
4
│  ┌─────────────┐         ┌─────────────┐           │
5
│  │ Hyperterse  │────────▶│   Database  │           │
6
│  │   Server    │ Private │             │           │
7
│  └──────▲──────┘  Net    └─────────────┘           │
8
│         │                                           │
9
└─────────┼───────────────────────────────────────────┘
10
          │ Public
11
    ┌─────┴─────┐
12
    │  Clients  │
13
    └───────────┘

Firewall rules

Allow Hyperterse to connect to database ports
Block direct database access from the internet
Restrict Hyperterse port (8080) to expected sources

Cloud examples

AWS:

Use RDS in a private subnet
Security groups allowing Hyperterse instances only
Deploy Hyperterse in the same VPC

GCP:

Use Cloud SQL with private IP
VPC network for Hyperterse
Firewall rules restricting access

Secrets management

For production, use a secrets manager:

AWS secrets Manager

# Fetch secret at runtime
export DATABASE_URL=$(aws secretsmanager get-secret-value \
  --secret-id prod/db/hyperterse \
  --query SecretString --output text)

hyperterse run -f config.terse

Hashicorp vault

export DATABASE_URL=$(vault kv get -field=url secret/database)
hyperterse run -f config.terse

Kubernetes secrets

1
apiVersion: v1
2
kind: Secret
3
metadata:
4
  name: hyperterse-secrets
5
stringData:
6
  DATABASE_URL: postgresql://user:pass@db:5432/app
7
---
8
apiVersion: apps/v1
9
kind: Deployment
10
spec:
11
  template:
12
    spec:
13
      containers:
14
        - name: hyperterse
15
          envFrom:
16
            - secretRef:
17
                name: hyperterse-secrets

Connection pooling

Configure connection pools appropriately:

1
adapters:
2
  production_db:
3
    connector: postgres
4
    connection_string: '{{ env.DATABASE_URL }}'
5
    options:
6
      max_connections: '10' # Match expected concurrency

Sizing guidelines:

Start with 5-10 connections per Hyperterse instance
Monitor database connection usage
Increase if you see connection wait times

Credential rotation

Plan for credential rotation:

Create new database user with new password
Update secrets manager
Restart Hyperterse (connections are re-established)
Revoke old credentials

For zero-downtime rotation, use multiple Hyperterse instances with rolling restarts.