Connect your databases

Why

Two things stopped teams from connecting. Their data lived in InfluxDB and they did not want to migrate it. Or their database was not reachable from the internet at all, only through a bastion host.

This release handles both, and tells you right away when something is wrong instead of leaving you with an empty chart.

InfluxDB, read in place

Paste your InfluxDB URL with the token, org and bucket as query parameters. Add v=3 for InfluxDB 3. Plexus lists your buckets and reads from your instance directly. Nothing is copied.

https://influx.example.com:8086?token=YOUR_TOKEN&org=YOUR_ORG&bucket=telemetry

SSH tunnel for private databases

For PostgreSQL, TimescaleDB and MySQL, open the SSH Tunnel (bastion host) section when you add the connection. Enter the bastion's host, port and username, and either a private key in PEM format or a password. Plexus opens a tunnel to the bastion, then connects to the database from there. If the database only listens on localhost on the bastion itself, use localhost:5432 in the connection string.

SSH credentials are encrypted at rest with AES-256. Use a dedicated bastion user whose key can only forward a port, so a leaked key cannot open a shell. Put this in front of the public key in that user's authorized_keys:

command="echo forward-only",no-pty,no-X11-forwarding,no-agent-forwarding,permitopen="localhost:5432" ssh-rsa AAAA...

Connection test

Plexus tests every connection the moment you add it. If the test fails, you stay on the form with the error, and SSH problems are reported as SSH problems, like a failed key or an unreachable bastion. If it passes, you go straight to picking tables.

Later, open the connection, choose Edit, and click Test Connection to check it again after you change a password or a firewall rule. The connection page shows Connected or Connection Error.

Limits

The SSH tunnel is available for PostgreSQL, TimescaleDB and MySQL. ClickHouse, QuestDB and InfluxDB connect directly, so they need to be reachable from Plexus.

How it works

Each database type is described once in Plexus. The connect dialog, the SQL editor and the panel builder all read from that one description, so they agree on what each database can do.

Plexus reaches each database with its own driver and your connection string. The string is encrypted at rest with AES-256. Queries go to your database at view time, so a chart is only as fresh as the data you have written there.

• PostgreSQL, TimescaleDB, MySQL: a standard postgresql:// or mysql:// URL.
• QuestDB: its PostgreSQL wire port, 8812. Port 9000 is QuestDB's HTTP interface and will not work.
• ClickHouse: a clickhouse:// URL, port 8443 for ClickHouse Cloud.
• InfluxDB: your instance URL with token, org and bucket as query parameters.

Using it

Go to Connections, choose Add connection, pick the type and paste the string. Each type has a short setup guide with the right URL format.

Plexus tests the connection as soon as you add it. If the test fails, you stay on the form and see the error. If it passes, you choose which tables to read. All are selected to start.

From there, generate a dashboard from the Connections page, or write your own SQL in a panel. The SQL editor understands Grafana-style time macros and says what they do in plain words, like "Limited to the dashboard's time range" or "Grouped into 5-minute buckets".

SELECT $__timeGroup(time, '5m') AS time, avg(battery_v) AS battery_v
FROM telemetry
WHERE $__timeFilter(time) AND device = 'rover-02'
GROUP BY 1
ORDER BY 1

Limits

InfluxDB speaks Flux and InfluxQL, not SQL, so the SQL editor and the point-and-click panel builder do not drive it. It is still a full connection for dashboards.

Plexus only needs to read. Give it a read-only database user where you can.

How it works

You approve Plexus on Supabase's own consent screen. Plexus then lists the projects that approval can see, and the tables in each one you choose.

For each project, Plexus runs SQL on your behalf through Supabase's Management API. That SQL creates a role called plexus_analytics with a password Plexus generates. The role can log in and run SELECT on the tables you ticked. It cannot create anything, cannot manage roles, and is limited to 5 connections. The password is encrypted at rest.

Row-level security needs one more step. A new role with no policy connects fine but gets zero rows back, which looks like an empty database. So Plexus adds a read-only policy for its own role on each table you picked. It does not use BYPASSRLS, which would let the role read every protected table in the database.

CREATE ROLE "plexus_analytics" WITH LOGIN PASSWORD '...'
  NOSUPERUSER NOCREATEDB NOCREATEROLE NOINHERIT NOREPLICATION
  CONNECTION LIMIT 5;

GRANT SELECT ON "public"."readings" TO "plexus_analytics";

CREATE POLICY "plexus_read_readings" ON "public"."readings"
  FOR SELECT TO "plexus_analytics" USING (true);

Using it

Go to Connections, choose Add connection, then Supabase.

• Approve access on Supabase. You land back in Plexus with the dialog still open.
• Choose one or more projects. Each project becomes its own connection.
• Tick the tables to read in each project, then click Connect read-only.
• Plexus tests each connection as it creates it. The last screen lists every project with its table count. If one project fails, the others still connect.
• Open the connection. A generated dashboard starts on the first few tables. The connection can read all the tables you picked.

Limits

Supabase's consent screen asks for read access to projects and organizations, and read and write access to databases. The write access is used once, at setup, to create the role and its policies. After that, Plexus reads your data over an ordinary Postgres connection as plexus_analytics.

To take access away, drop the plexus_analytics role and the plexus_read_ policies from your project.