Web Interface on a Hostname
Put the DBTrail web interface on console.example.com with TLS, covering DNS, certificate, and the Host header rule that returns 403 until you set it.
- DNS: an
AorAAAArecord to the host. - Firewall: open 443; keep 8090 closed.
- TLS: one of the two shapes below.
- Allow the hostname, or every request answers
403.
A credential comes first
A daemon on a non-loopback address refuses to start without a
password or --token.
TLS
The daemon terminates TLS
bintrail-console serve --index-dsn '<dsn>' \
--listen 0.0.0.0:8090 \
--tls-cert /etc/ssl/console.crt \
--tls-key /etc/ssl/console.key \
--allowed-hosts console.example.comOn watch: --console-tls-cert, --console-tls-key.
A reverse proxy terminates TLS
The web interface stays on loopback; certificate renewal comes with the proxy.
server {
listen 443 ssl;
server_name console.example.com;
ssl_certificate /etc/letsencrypt/live/console.example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/console.example.com/privkey.pem;
location / {
proxy_pass http://127.0.0.1:8090;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-Proto $scheme;
# backup and .sql downloads stream as they are built
proxy_buffering off;
}
}The header rule
HTTP 403
{"error": "forbidden: host not allowed"}A defence, not a misconfiguration: without a Host check, a web page resolving
a hostname to 127.0.0.1 could drive your web interface (DNS rebinding). Allow the
name:
--allowed-hosts console.example.com # serve
--console-allowed-hosts console.example.com # watch
BINTRAIL_CONSOLE_ALLOWED_HOSTS=console.example.comDropping proxy_set_header Host also "works": nginx then sends
127.0.0.1:8090, an IP literal, always allowed. But the real hostname never
reaches the daemon or its logs. Pass Host and list it.
The MCP endpoint rides the same rule: https://console.example.com/mcp, behind
the same credential.
MinIO, Wasabi and other S3-compatible storage
Point DBTrail's archives and baselines at a store that speaks the S3 API but is not AWS, with uploads and reads aimed at the same place.
Install from Linux packages
DBTrail on a Linux host without Docker, from the .deb or .rpm, as a systemd service that starts at boot and restarts after a crash.