−25%

on annual Windows plans, until 31 Oct. See plans

EQVPS

How to install PostgreSQL on a VPS and connect safely

Install PostgreSQL 16 on Ubuntu, create a database and user, and reach it remotely without exposing port 5432 to the internet — SSH tunnel or allowlist.

PostgreSQL itself installs in one command. The part people get wrong is remote access: they open port 5432 to the world, set a password, and wonder why the logs fill up with login attempts. This guide installs Postgres on Ubuntu 24.04, creates a database, and shows two safe ways to connect from outside.

1. Install

apt update && apt install -y postgresql
systemctl status postgresql --no-pager

On Ubuntu 24.04 that's PostgreSQL 16. It listens only on localhost by default — keep it that way unless you have a reason.

2. Create a user and a database

sudo -u postgres psql <<'SQL'
CREATE USER app WITH PASSWORD 'use-a-long-random-password';
CREATE DATABASE appdb OWNER app;
SQL

Apps running on the same server connect with postgresql://app:PASSWORD@localhost:5432/appdb.

Nothing to open, nothing to configure on the server. The tunnel forwards a local port through SSH:

ssh -N -L 5433:localhost:5432 root@203.0.113.10

On a NAT plan, add your personal SSH port from the dashboard:

ssh -N -p 20123 -L 5433:localhost:5432 root@your-nat-host

While the tunnel runs, point your database client at localhost:5433. Everything is encrypted by SSH, and port 5432 stays closed to the internet. GUI tools like DBeaver and pgAdmin have an "SSH tunnel" tab that does the same thing.

4. Direct access for another server (allowlist)

If an app server elsewhere must connect directly, allow only its IP. This needs a dedicated-IP plan for the database server, since NAT plans don't accept inbound connections apart from SSH.

In /etc/postgresql/16/main/postgresql.conf:

listen_addresses = '*'

At the end of /etc/postgresql/16/main/pg_hba.conf:

hostssl  appdb  app  198.51.100.20/32  scram-sha-256

Open the firewall for that one address and restart:

ufw allow from 198.51.100.20 to any port 5432 proto tcp
systemctl restart postgresql

hostssl forces an encrypted connection — Ubuntu's package ships a self-signed certificate, so clients should connect with sslmode=require.

5. Sensible first tuning

For a server with 2 GB RAM, in postgresql.conf:

shared_buffers = 512MB
effective_cache_size = 1536MB
work_mem = 8MB

Restart after changing. That's enough for most small apps; tune further once you see real queries.

6. Backups

A nightly dump, kept for a week:

mkdir -p /var/backups/pg && chown postgres /var/backups/pg
cat > /etc/cron.d/pg-backup <<'EOF'
30 3 * * * postgres pg_dump -Fc appdb > /var/backups/pg/appdb-$(date +\%u).dump
EOF

-Fc produces a compressed dump you restore with pg_restore. Copy dumps off the server as well; Managed Backups add daily restore points of the whole machine.

FAQ

Should I open port 5432 to the internet?

Avoid it. Exposed database ports get scanned and brute-forced constantly. Connect through an SSH tunnel, or if an app server must connect directly, allow only that server's IP in both pg_hba.conf and the firewall.

Can I use PostgreSQL on a NAT plan?

Yes. Apps on the same server connect locally, and you reach the database from your laptop through an SSH tunnel on your personal SSH port. What a NAT plan can't do is accept a direct inbound connection on 5432 from another server.

How much RAM does PostgreSQL need?

It runs in a few hundred megabytes, and uses whatever you give it for caching. A common starting point is shared_buffers at about 25% of RAM. For a small app database, 2 GB of server RAM is comfortable.

How do I back up the database?

Use pg_dump with the custom format ('pg_dump -Fc') and run it from cron. Keep copies off the server too. Managed Backups add daily restore points of the whole server.

Which PostgreSQL version do I get?

Ubuntu 24.04 ships PostgreSQL 16, Debian 12 ships 15. For a newer major version, add the official PostgreSQL apt repository (apt.postgresql.org).

Comments

No comments yet. Be the first.

Leave a comment

Comments are moderated before they appear.