Postgres on Your Own Server, Backed Up
Point-in-time backups and TLS, without a managed database bill.
The database is the part you can't lose.
So backups are on from the first boot.
us.kheeper.com/public/postgres
- PostgreSQL from Fedora, initialised on first boot
- WAL-G archiving every WAL segment, plus a daily base backup
- A Let's Encrypt certificate on 5432 — even with no domain, via an IP certificate
- Password logins over TLS only; the superuser is local-only
- Grafana and postgres_exporter, with a Postgres dashboard
A managed database bills for the convenience.
The convenience is backups and certificates.
Per instance, plus extras
RDS and Cloud SQL charge a premium over the same VM, then again for storage, IOPS, backup retention and the data you move out.
Cheap until it isn't
A Postgres on a VM costs little, until the day you need the backups you meant to set up, or the certificate expired.
One box, backups included
WAL archiving, base backups, TLS and metrics ship in the image. Kheeper charges for storage, bandwidth and hosts, and backups land in Kheeper's object store.
Questions
How do backups work?
WAL-G pushes every WAL segment to Kheeper's object store as Postgres writes it, and a timer takes a full base backup daily, keeping the last seven. The host authenticates with its own key, so no storage credentials sit on disk.
Do I need a domain?
No. Without one the image detects the host's public IP and issues a short-lived Let's Encrypt certificate for it, renewed automatically. Each host also gets a name under kheeper.app you can use.
How do clients connect?
Configure database users with passwords and they can connect over TLS with scram-sha-256 from anywhere. The postgres superuser has no password and is reachable only on the host.
Can I build my own app on it?
Yes. postgres-base is the same Postgres, backups and metrics with no public listener, for layering your own service on top. Forgejo, OpenFGA and Keycloak are built that way.