Applications and operations
Keep connection configuration out of code
Keep credentials in deployment secrets, bound connection waits, and verify remote MySQL connections with the provider's TLS certificate.
8 minute lesson
~~~
Keep the host, port, full account name, password, and database in deployment secrets. Do not commit them, print them in logs, or put them in browser code.
Use a short connection timeout and a bounded pool queue. They turn a network or capacity problem into a controlled failure instead of an unlimited wait.
Remote database connections need TLS. Use the certificate authority supplied by the hosting provider:
ssl: {
ca: process.env.DB_CA,
minVersion: 'TLSv1.2',
}Do not fix certificate errors with rejectUnauthorized: false. Fix the CA, hostname, or provider configuration.
Lesson completed