---
title: MySQL
url: "/docs/databases/mysql/"
canonical_url: https://docs.blossom88.com/docs/databases/mysql/
markdown_url: https://docs.blossom88.com/docs/databases/mysql.md
summary: MySQL databases with recovery backups, public access over TLS, and a stable
  private endpoint
categories:
- data
- databases
- mysql
---

# MySQL

Blossom runs MySQL 9 as a Database with a stable private endpoint, generated
credentials, encrypted recovery backups, and opt-in public access over TLS.

## Dedicated Node And Storage

A Dedicated Database is one MySQL node on its own Server, with its data on
separate storage that follows the node. You choose the region and the storage
size in GB; Blossom provisions the Server, attaches the storage, starts MySQL
only from that storage, and reports each step in Activity. Storage grows
online while MySQL keeps serving and never shrinks. When a Server fails,
Blossom confirms the failure, reattaches the same storage to a replacement
Server, and starts MySQL from the same data behind the same endpoint.

    blossom database_instance:init

writes database_instance.yml; set `engine: mysql`:

```yaml
database_instance:
  name: production
  engine: postgres # postgres, mysql, mariadb, or mongodb
  availability: shared # the default where the Location has Data Capacity; or dedicated, its own Server
  storage_gib: 20 # 10 to 1000 GB; grows online later, never shrinks
  # ...
```

    blossom database_instance:create --data database_instance.yml --follow

## Recovery Backups

Select Backup Storage to enable encrypted logical recovery backups. Each
backup is a transaction-consistent `mysqldump` of the database, encrypted
before it leaves the node. Blossom creates the initial backup automatically,
and a completed backup restores an independent Database while the source
lives or after it is deleted. MySQL backups restore to the backup's own
consistency point; point-in-time recovery is a PostgreSQL feature.

## Public Access

A Database is private by default. Turning public access on gives it one public
name that answers only over TLS, with a certificate Blossom issues and renews,
and only to the source addresses you list. MySQL terminates the TLS itself and
refuses plaintext connections. Private links, credentials, and data do not
change, and turning public access off withdraws the name, the network path,
and the certificate.

Public access needs Dedicated availability. A Shared Database stays
private to its linked Environments; choose Dedicated when it must be reachable
from the Internet.

    blossom database_instance:update --id database_instance-100 --data '{"database_instance":{"public_access":true,"public_allowed_sources":["203.0.113.4/32"]}}'
    blossom database_instance:credentials --id database_instance-100

Connect with a client that verifies the server certificate, such as
`mysql --ssl-mode=VERIFY_IDENTITY`. The password is shown only by
`database_instance:credentials` on an explicit request.

## Connect

Create an Environment Link with `target_type: DatabaseInstance`. Blossom supplies a
private `DATABASE_URL` containing the generated credentials, endpoint, port,
and database name to every Service in the Environment. Applications should
use that URL rather than a provider address or Container name.

The current MySQL scope is one primary. Read replicas, standbys, automatic
failover, and database monitoring are not available for MySQL.

- [Databases](/docs/databases/)
- [Database And Cache Security](/docs/databases/security/)
- [MySQL documentation](https://dev.mysql.com/doc/)