Originally published on the Hubfly space blog.
Running Postgres yourself means patching it, guarding the port and rotating passwords, or leaving your data on an app volume one bad redeploy from trouble.
TL;DR
- What you get: a PostgreSQL 18 database that Hubfly space runs for you, with TLS on every connection, an IP allowlist, pgvector ready to install, and a connection string written straight into your app.
- Who it's for: side projects, small SaaS apps and AI features that need Postgres but not a database admin.
- Time needed: about 10 minutes. The database itself is ready in about a minute and a half.
- Cost: about $2.02 a month for the smallest size. You can stop it and pay about $0.11 a month for storage.
In this guide you'll create a managed PostgreSQL database on Hubfly space, add vector search, lock it to your network and connect an app without copying a password anywhere. You'll know exactly what Hubfly space runs for you, what it still leaves to you, and what it costs to the cent.
What Hubfly space runs, and what you still own
Managed Databases are a new project type on Hubfly space. One managed project can hold several databases (PostgreSQL, MySQL or SQLite through libSQL) and Realtime servers.
| Hubfly space does this | You still do this |
|---|---|
| Creates the server and its storage, picks where it runs | Choose the size and grow storage when you need it |
| Generates and encrypts passwords, refuses connections without TLS | Decide who may connect (IP allowlist, one user per app) |
| Start, stop, restart, resize, version updates, config changes with automatic rollback | Keep your own copies of the data (see the limits below) |
| Metrics, logs, sessions, query insights and alerts | Read them and act on them |
You get an admin user that can create databases and users and read and write everything. It is not a superuser, so anything that needs superuser rights won't work.
Step 1: Create a managed project
Open the dashboard, click Create Project, give it a name like shop-data, and pick Managed service. There's no region to choose: Hubfly space places the database for you. Open Advanced Options and set a monthly budget if you want a spending alarm on this project.
The project opens on a page with three cards: Database, Realtime and Cache (Cache is marked Coming soon). Click Create a database.
Step 2: Pick the engine, size and name
The form has one section per decision:
- Engine and version: PostgreSQL 18 is the default (17 and 16 are also offered).
- Size: Nano (0.25 vCPU, 512 MiB) is enough for a prototype or a small app. PostgreSQL needs at least 512 MiB.
- Storage: 10 GiB by default, from 1 to 500 GiB. It can grow later but never shrink, so start small.
- Network & access: public access is on, and the allowlist is empty. You'll lock it down in Step 5.
-
Instance name: for example
shop-db. It becomes part of the hostname.
The price panel updates as you change the form and splits the cost into compute, storage and management:
Click Create database. The page lists nine provisioning steps as they run, from "Reserving capacity" to "Registering hostname". Expect about a minute and a half until the status turns Running.
The header shows your hostname and port, such as shop-db-xxxx.db.hubfly.app:30010. Note the port: it is assigned to your instance and it is not 5432. Copy it from the page rather than guessing.
Step 3: Get your connection string
Open Connect. It shows the host, port, database (app), user (admin) and a hidden password. Reveal shows the password for a minute, and every reveal is written to the access log, so you can see who looked at it.
Under Connection string and snippets you can copy a ready-made string for URI, .env, psql, Prisma, Drizzle, Node (pg), Python, Go (pgx), JDBC or PHP (PDO). All of them include sslmode=require, because the database refuses unencrypted connections. To also verify the server's identity, download the instance's CA certificate from the same page.
Step 4: Add vector search with pgvector
If you're building search, recommendations or an AI feature, you can keep your embeddings next to the rest of your data. Open Extensions, find vector (pgvector 0.8.7), click Install and confirm. PostGIS, pg_trgm, pgcrypto, uuid-ossp and pg_stat_statements are on the same list.
Now open the SQL editor. It opens in read-only mode every time, which protects you from a stray DELETE. Turn Read-only off, then run:
CREATE TABLE products (id bigserial PRIMARY KEY, name text NOT NULL, embedding vector(3));
INSERT INTO products (name, embedding) VALUES
('red running shoes', '[0.9,0.1,0.0]'),
('blue trail shoes', '[0.8,0.2,0.1]'),
('wool winter hat', '[0.0,0.1,0.9]');
SELECT name, round((embedding <=> '[1,0,0]')::numeric, 3) AS distance
FROM products
ORDER BY embedding <=> '[1,0,0]'
LIMIT 2;
Each statement gets its own result tab. The query returns the two shoes, closest first:
Real embeddings have hundreds of dimensions instead of 3, but the query is the same. The editor works through Hubfly space, so it needs no allowlist entry and no local client.
Step 5: Lock it to your network
An empty allowlist means anyone with the password can try to connect from anywhere. Open Network, click Add entry, and add your office or server range, for example 203.0.113.0/24 with the label office. Add my IP fills in the address you're browsing from. Click Save allowlist. The change applies in about 10 seconds and the status changes to "Public, limited to 1 allowed range".
You can add up to 64 addresses or CIDR ranges. Hubfly space enforces the list in its proxy, before a connection reaches Postgres.
One catch: connected Cell apps reach the database through the same public endpoint, so the allowlist applies to them too. After you restrict the list, add the addresses your apps connect from and confirm they still connect. Keep Public access on while apps use the connection string, because it points at the public endpoint.
Step 6: Connect your app without copying passwords
Open Apps and click Connect an app. Pick the Cell project that runs your app, keep the variable name DATABASE_URL, and leave Create a dedicated user ticked with Read & write. Click Connect app.
Hubfly space creates a separate database user for the app and writes the full connection string into the project as a Secret variable:
Why a dedicated user? If you ever rotate the admin password, this app keeps working. If you disconnect the app, its user is dropped. Redeploy the app after connecting: apps read variables at deploy time. Deleting the database later also removes DATABASE_URL from the project, so reconnect or redeploy the app with a new database first.
What it costs
Managed Databases use the same rates as dedicated Cell resources, plus a 30% management fee on CPU and memory while the database runs. Monthly figures use 730 hours.
For Nano with 10 GiB of storage:
- Compute: 0.25 vCPU × $0.004 + 0.5 GiB × $0.002 = $0.002 per hour, plus the 1 GiB system disk at $0.00001536 per GB-hour = $0.00201536
- Management: 30% × $0.002 = $0.0006 per hour
- Storage: 10 GiB × $0.00001536 per GB-hour = $0.0001536 per hour
- Total: $0.00276896 per hour × 730 = about $2.02 a month
| Size | vCPU / memory | Per month (10 GiB) |
|---|---|---|
| Nano | 0.25 / 512 MiB | $2.02 |
| Small | 0.5 / 1 GiB | $3.92 |
| Medium | 1 / 2 GiB | $7.72 |
A stopped database pays only for storage: about $0.11 a month for 10 GiB. The database is billed from your account balance. It isn't part of the free tier's 360 hours. If your balance runs out, Hubfly space stops the database and starts it again after you top up.
What can go wrong
- "cannot execute CREATE TABLE in a read-only transaction" (error 25006). The SQL editor starts in read-only mode. Switch Read-only off before writing, and switch it back when you're done.
- Your client or app times out. Check the port (it isn't 5432) and the allowlist. Once the list has entries, only those ranges can connect, your laptop and your apps included.
-
Your app still can't see
DATABASE_URL. Apps read variables at deploy time. Redeploy after you connect, disconnect or rotate credentials.
Go further on Hubfly space
- Run untrusted or AI-generated code next to it with one container per task.
- Add live updates with Realtime, a Pusher-compatible WebSocket server you create from the same managed project (docs home).
- Store product images on Storage and resize them with a URL.
- Ship every push automatically with GitHub Actions and a deploy webhook.
- Read the full Managed Databases guide for MySQL, libSQL tokens and configuration changes.
Start free
Create a free account (no card needed, 360 hours of shared compute a month for your app), add balance when you're ready for the database, and have Postgres with pgvector running in about 10 minutes.
Top comments (0)