I'm trying to determine the best, modern practice for using your own separate database server for a web-app. I have an app server,
appserver1, (running php, nginx, etc, not that that matters much), and a db server;
dbserver1 (running postgresql, which probably doesn't matter).
I want to use the command line
psql command and app database connections from
appserver1 that connect to the database on
dbserver1. Both are on the same internal network at rackspace, so the connection is fast. However, I don't want to trust that connection if it's standard protocol not to, so if it's necessary to secure that connection further, how can I best secure that connection?
Securing the Connection
I have heard of ssh tunnelling, though I haven't used it before. It seems pretty simple, overall. Should I set up an ssh tunnel from
appserver1 that points at
dbserver1 and then I'll be able to connect as if it were all localhost? Or else what should my approach be?
Edit: Can I just set the server to only listen to localhost and the ip of the web servers, or is that not a maintainable solution, long term?