I'm trying to determine the best, modern practice for using your own separate database server for a web-app. I have an app server, appserver1
, (running php, nginx, etc, not that that matters much), and a db server; dbserver1
(running postgresql, which probably doesn't matter).
I want to use the command line psql
command and app database connections from appserver1
that connect to the database on dbserver1
. Both are on the same internal network at rackspace, so the connection is fast. However, I don't want to trust that connection if it's standard protocol not to, so if it's necessary to secure that connection further, how can I best secure that connection?
Securing the Connection
I have heard of ssh tunnelling, though I haven't used it before. It seems pretty simple, overall. Should I set up an ssh tunnel from appserver1
that points at dbserver1
and then I'll be able to connect as if it were all localhost? Or else what should my approach be?
Edit: Can I just set the server to only listen to localhost and the ip of the web servers, or is that not a maintainable solution, long term?