Connections
A connection is a name, an environment and the settings Recern needs to reach a database. Connections are saved on your computer. Passwords and Qdrant API keys are not part of them: they are kept in the system keychain.
Environments
Every connection has an environment: Local, Development, Staging or Production. Choose By environment or By group in the sidebar. The dashboard continues to group by environment and shows production first.
A new Production connection gets Safe Mode turned on. For engines with a write-capable console, you can turn it off in the connection settings, but Recern warns that it could then change data on that server. See Safe Mode and the console.
Connection groups
Click Manage groups beside the sidebar grouping menu to assign group names and change the connection order. Choose By group to see your groups; connections without a group appear under Ungrouped. Group names and order are saved on your computer. Environment labels and Safe Mode remain separate from groups.
PostgreSQL
| Setting | Notes |
|---|---|
| Host and port | 5432 by default. |
| User and database | The database Recern opens first. |
| Password | Stored in the system keychain. |
| TLS | Disable, or Require: the connection is encrypted and the server certificate is verified. |
The Queries view needs the pg_stat_statements extension in the database. Without it, the Queries tab does not appear, and the other views work as usual.
MySQL
| Setting | Notes |
|---|---|
| Host and port | 3306 by default. |
| User and database | Database is optional; set one for unqualified table names in the console. |
| Password | Stored in the system keychain. |
| TLS | Disable, or Require with certificate and host-name verification. |
MySQL 8 is the tested baseline. Sessions, locks, query digests, InnoDB and replication diagnostics depend on the server version, enabled Performance Schema instruments and the account's permissions. Recern reports unavailable diagnostics in the affected view; it does not grant permissions or change server settings for you.
Microsoft SQL Server
Use SQL authentication, a fixed TCP endpoint (1433 by default) and a database name. TLS verifies the server certificate and hostname; a private PEM CA and SSH forwarding are supported. Windows/Entra authentication, SQL Browser instance discovery and Azure SQL are not included. The console is always read-only. See Microsoft SQL Server for diagnostics, permissions and limits.
MongoDB
Use one host and port (27017 by default), the database to inspect and a separate Authentication database (default admin). Choose TLS with certificate verification for a direct encrypted connection; a private CA can be supplied as a local PEM file. The adapter uses a single-server connection, without SRV or automatic replica discovery. Its console is read-only. See MongoDB for permissions, views and JSON examples.
ClickHouse
Use the HTTP port (usually 8123) or HTTPS port (usually 8443 with TLS required), plus the username, password and database (default default). Port 9000 is not supported. A private CA can be supplied as a local PEM file. HTTPS through SSH requires the database's DNS hostname. Its console is read-only. See ClickHouse for diagnostics and request limits.
Cassandra
Use the CQL port (9042 by default), optional credentials and an optional keyspace. Workspace connects only to the configured endpoint, including through SSH, and verifies the original host when TLS is required. Its console accepts one bounded, read-only SELECT. See Cassandra.
Qdrant
Use the REST port (6333 by default), an API key and optionally a collection scope. A scoped connection skips global discovery and reads only that collection. Use the HTTPS port configured by your service when TLS is required. Its console supports read-only query, scroll, count and retrieval. See Qdrant.
OpenSearch
Use the REST port (9200 by default), HTTP Basic credentials when required and an optional concrete index or alias scope. TLS verifies the certificate and hostname; a private PEM CA bundle is supported. The adapter always reads only. Access & limits displays available account-permission evidence, separately from Safe Mode. See OpenSearch for supported queries, limits and the tested server version.
Private TLS certificates
Microsoft SQL Server, MongoDB, ClickHouse, Cassandra, Qdrant and OpenSearch show CA certificate file (optional) when TLS is required. Choose a PEM certificate bundle; ~/ paths work. The bundle becomes this connection's trust source and the hostname is always verified. Workspace saves the path, not the certificate contents. Turning TLS off clears the custom CA setting in the connection form.
Redis, Valkey and Dragonfly
| Setting | Notes |
|---|---|
| Host and port | 6379 by default. |
| User | Optional, for servers with ACL users. |
| Password | Optional. Stored in the system keychain. |
| TLS | Disable or Require. |
Recern names its connections Recern with CLIENT SETNAME, so they are easy to spot in the Clients view and on the server.
SQLite
Choose an existing SQLite database file. Diagnostic views use a read-only connection. The console can write when Safe Mode is off; in Safe Mode it also opens read-only and blocks operations such as attaching another database or changing unsafe pragmas. No host, password, TLS or SSH settings are needed.
Recern Vector
Choose an existing .rvec file. Workspace uses Recern Vector 0.2.0 to read format-1 and format-2 snapshots, committed WAL changes, and f32 or int8 collections. It watches both the snapshot and its .wal sidecar and reloads when either changes. Recern never writes to this database.
If you move or copy a database, first call checkpoint() in the owning application while writes are paused; the resulting snapshot is self-contained. Otherwise, keep the matching snapshot and WAL together. See Vector file format.
Passwords
Passwords and Qdrant API keys are stored in the system keychain under the connection's id and are never written to the configuration file. Deleting a connection deletes its stored secret too.
Through a bastion
To reach a database that is only visible from a private network, add an SSH tunnel to the connection. See SSH tunnels.