Public and private: what should be reachable

Narration uses an AI-generated voice.

[00:00] Where we're going

By the end of this video, you'll be able to decide which parts of your app need a public address. And you'll know why the database should never be one of them.

[00:09] Public and private

Here's the rule. Give a public address only to what visitors must reach. Usually, that's just the load balancer. Everything else belongs on a private network, and above all, the database. On a private network, the internet has no way in.

[00:26] Private addresses

So what makes an address private? Three ranges are reserved for private networks. Everything starting with ten. One seventy-two dot sixteen, up to one seventy-two dot thirty-one. And everything starting with one ninety-two dot one sixty-eight. Routers on the internet don't carry traffic to these addresses. So nobody outside can connect to ten dot zero dot two dot twenty directly.

[00:53] Reaching out

Your home router uses the same trick. Your laptop is probably on a one ninety-two dot one sixty-eight address. And one public address stands for the whole house. Servers on a private network can still reach out. Say, to call a payment API, or to download updates. Outbound connections work. Nothing unrequested gets in.

[01:16] Why the database stays private

Anything with a public address gets probed within minutes of appearing. Automated scanners sweep the whole internet for open database ports. Five four three two, for PostgreSQL. Three three oh six, for MySQL. And six three seven nine, for Redis. Then they try default passwords, and known bugs.

A private database removes that risk entirely. To reach it, an attacker must first break into one of your servers. Leaked databases often weren't hacked in any clever way. They were simply open. Sometimes with no password at all.

[01:55] Deciding, part by part

So, for each part of your app, ask one question. Does a visitor's browser need to connect to it? The load balancer? Yes. It's public, on ports four forty-three and eighty. The app servers? No. Only the load balancer talks to them. Internal services and workers? No. Other servers call them. The database and cache? No. Only your app servers connect.

A firewall enforces these choices. It lists which connections may come in. Everything else is blocked by default.

[02:32] If it has to be public

Sometimes a database has to be public. Some hosted providers give you only a public endpoint. Then lock it down. First, require TLS. Next, a long random password for that one database user. And where you can, limit which addresses may connect. Never leave the default user or password in place.

[02:54] On ComputeSphere

On ComputeSphere, each environment has its own network. Private Network is set when you create the environment. With it turned on, services in the same environment reach each other directly, without going over the internet. Services in other environments can't.

[03:11] Recap

So, a quick recap. Only what visitors must reach gets a public address. Usually, just the load balancer. App servers, workers, and above all the database stay on a private network. And a firewall blocks every connection you didn't allow.

Here's a question to check yourself. Your app has a load balancer, two app servers, a worker, and a PostgreSQL database. How many need a public address? Just one. The load balancer. I'll see you in the next lesson.