Firewall and allowlist

Every new database has its firewall on, with a default of deny: nothing can connect until you add an allow rule.

Default deny is guaranteed

• A database is never reachable before its firewall is in place: the rules are installed before the database’s port opens, and if they can’t be, the database is not created.
• DockHive keeps every database’s rules in place and repairs anything that goes missing.
• Anything that lets any internet address connect (a default of allow, an allow rule for 0.0.0.0/0, or a disabled firewall) is flagged with a red Open to the internet badge in the console, in hivepod db list and in the MCP tools.
• Databases accept IPv4 connections only.

Who can I allow?

Who connects	What to allow
Your DockHive app or HivePod in the same region as the database	The app or pod itself (see Allow your apps and pods). It keeps access when it is redeployed.
Your computer	Add My Current IP, or hivepod db firewall <db> allow <your ip>
An office, server or VPN with a fixed address	Its public IPv4 address or range
A CI runner	See CI runners
An app or pod in another region	That region’s shared outbound address, which other customers also use. Prefer creating the database in the app’s region.

In the console

Open the database and go to the Firewall tab. Until you add a rule it shows All connections are blocked.

Allow an address

1. Under Allow an IP Address, enter an IPv4 address such as 203.0.113.4, or a range in CIDR notation such as 203.0.113.0/24.
2. Optionally add a Label (for example Office or CI runner) so you remember what the rule is for.
3. Click Add Rule.

The rule appears in Firewall Rules and applies immediately. If you type an address with a range (203.0.113.77/24), it’s saved as the range it belongs to (203.0.113.0/24); the form shows this before you add it.

Allow your current IP

Click Add My Current IP to allow the public address your browser is using right now, labelled My IP. This is what you want when you connect from your own computer with a database client.

If your network reached DockHive over IPv6, the console tells you so instead: databases accept IPv4 connections only, so look up your IPv4 address (for example with curl -4 ifconfig.me) and add it by hand.

Note

Your public address can change, for example on home broadband, mobile data or a VPN. If you suddenly can’t connect, add your new address.

Allow your apps and pods

Under Allow Your Apps and Pods:

• Allow All My Apps lets every app you deploy in the database’s region connect.
• Allow All My Pods does the same for your HivePods.
• Or pick App id or Pod id and enter one app’s id (for example my-shop) or one pod’s id.

These rules name the app or pod, not an address: DockHive follows its current internal address on the database’s server as it is redeployed or restarted, and only ever for apps and pods that belong to you. The rule shows the address it uses right now, or Not running on this database’s server right now. The internet stays blocked.

They work for apps and pods in the same region as the database. A workload in another region reaches the database from its region’s shared outbound address, which other customers also use.

In the US region, HivePods connect to databases from the region’s shared pod address. A pod rule there allows that address while you have a matching pod, so other workloads using the same address can reach the database’s port too. Your password and TLS still protect it.

CI runners

• Self-hosted runner or fixed egress IP: allow that address or range once.
• Hosted runners (for example GitHub Actions): their addresses change on every run and their published ranges are huge. Add the runner’s address at the start of the job and remove it at the end with an API key:

IP=$(curl -4 -s https://ifconfig.me)
RULE=$(curl -s -X POST "https://api.dockhive.io/api/v1/databases/$DB/firewall/rules?region=$REGION" \
  -H "Authorization: Bearer $DOCKHIVE_API_KEY" -H "Content-Type: application/json" \
  -d "{\"ip_address\": \"$IP\", \"action\": \"allow\", \"description\": \"CI run\"}" | jq -r .rule_id)
# ... run migrations or tests ...
curl -s -X DELETE "https://api.dockhive.io/api/v1/databases/$DB/firewall/rules/$RULE?region=$REGION" \
  -H "Authorization: Bearer $DOCKHIVE_API_KEY"

Allow from anywhere

Allow From Anywhere (0.0.0.0/0) lets every IPv4 address connect. The console asks you to confirm and then shows a red Open to the internet warning, and the database carries the same badge in the list, for as long as the rule exists. Only the database password (and TLS) then protects your data. Avoid it: allow your apps, pods and addresses instead.

Close to the internet in that warning removes the 0.0.0.0/0 rule and sets the default back to deny.

Remove a rule

Click the bin icon next to a rule and confirm. The address can no longer connect, including connections that are already open. Removing the last allow rule closes the database again.

The Settings tab also shows the firewall state (for example Closed until an allowed IP address is added) with a Manage link to this tab.

Teams

In a team workspace, viewers can see the rules but not change them. Owners, admins and developers can add and remove rules.

With the CLI

hivepod db list                                   # the firewall column flags OPEN TO INTERNET
hivepod db firewall shop                          # rules, and the addresses app/pod rules use now
hivepod db firewall shop allow 203.0.113.4        # an IPv4 address or CIDR range
hivepod db firewall shop allow --app my-shop      # one app (or --pod <name>, --all-apps, --all-pods)
hivepod db firewall shop remove 7                 # remove rule 7
hivepod db firewall shop deny-all                 # close it: only the allow rules can connect

With an AI agent (MCP)

hivepod mcp gives agents database_firewall, database_firewall_allow (an IPv4 address, an app, a pod, or all your apps/pods), database_firewall_remove and database_firewall_default. Opening a database to the internet needs an explicit confirm, and list_databases warns about any open database.

With the API

You can manage the same rules with the API and an API key, for example from a deploy script. Add ?region=<region> (the database’s region) to each call.

export DOCKHIVE_API_KEY=dh_pat_...
export DB=3f2a9c1b7e4d      # the database id, from the console URL or GET /api/v1/databases
export REGION=eu

Allow an address

curl -X POST "https://api.dockhive.io/api/v1/databases/$DB/firewall/rules?region=$REGION" \
  -H "Authorization: Bearer $DOCKHIVE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"ip_address": "203.0.113.4", "action": "allow", "description": "office"}'

Field	Notes
ip_address	Required. An IPv4 address (203.0.113.4) or range (203.0.113.0/24). IPv6 is not supported.
action	Required. allow or deny.
cidr_mask	Optional prefix length for a bare address, default 32 (a single address). Use 24 for a /24 range.
priority	1 to 10000, default 100. Lower numbers are checked first; the first match wins. The default action applies last.
description	Optional label, up to 255 characters.

The response contains the saved rule. A second rule for the same range is refused, and a database can have up to 100 rules.

Allow an app or pod

curl -X POST "https://api.dockhive.io/api/v1/databases/$DB/firewall/rules?region=$REGION" \
  -H "Authorization: Bearer $DOCKHIVE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"source": "platform:app:my-shop"}'

source	Allows
platform:app:<app id>	That app, in the database’s region
platform:app:*	All your apps in the database’s region
platform:hivepod:<pod id>	That pod (its id from GET /api/v1/hivepods/)
platform:hivepod:*	All your pods in the database’s region

An app or pod id that isn’t yours answers 404. Listed rules have "type": "platform" and resolved_ips (the addresses in use right now).

Is it open?

GET /api/v1/databases and GET /api/v1/databases/$DB include firewall: enabled, default_action, rules_count and open_to_internet (with open_reason when it is true).

List and remove rules

curl "https://api.dockhive.io/api/v1/databases/$DB/firewall/rules?region=$REGION" \
  -H "Authorization: Bearer $DOCKHIVE_API_KEY"

curl -X DELETE "https://api.dockhive.io/api/v1/databases/$DB/firewall/rules/RULE_ID?region=$REGION" \
  -H "Authorization: Bearer $DOCKHIVE_API_KEY"

Shortcuts

Call	Effect
POST …/firewall/allow-all	Allows every address (0.0.0.0/0).
POST …/firewall/deny-all	Denies every address.
POST …/firewall/default-action with {"action": "deny"} or "allow"	Changes what happens when no rule matches. allow opens the database to the internet; the answer carries a warning.
POST …/firewall/toggle with {"enabled": false}	Turns filtering off entirely. The database is then open to every address.
GET …/firewall/status	Shows whether the firewall is on, the default action and rule counts.

All paths start with https://api.dockhive.io/api/v1/databases/$DB and need ?region=$REGION.