> ## Documentation Index
> Fetch the complete documentation index at: https://docs.fly.io/llms.txt
> Use this file to discover all available pages before exploring further.

# EdgeDB on Fly

[EdgeDB](https://www.edgedb.com) is a [graph-relational database](https://www.edgedb.com/blog/the-graph-relational-database-defined) that runs on top of Postgres and is designed as a spiritual successor to SQL. This guide explains how to perform a single-region deployment of EdgeDB with persistent storage. It will require two apps: one for Postgres and one for the EdgeDB container.

## Create the Postgres app

Create a Postgres app. You'll need to replace `mypostgres` with a unique name of your choosing.

<CodeGroup>
  ```bash cmd theme={null}
  flyctl postgres create \
    --name mypostgres \
    --vm-size performance-1x \
    --volume-size 10 \
    --initial-cluster-size 1
  ```

  ```output output theme={null}
  Automatically selected personal organization: <Your Name>
  ? Select region: sea (Seattle, Washington (US))
  Creating postgres cluster mypostgres in organization personal
  Postgres cluster mypostgres created
    Username:    postgres
    Password:    <generated passworD>
    Hostname:    mypostgres.internal
    Proxy Port:  5432
    PG Port: 5433
  Save your credentials in a secure place, you won't be able to see them again! 
  ```
</CodeGroup>

## Create the EdgeDB app

Create a directory and create a new app. Be sure to replace `myedgedb` with a custom name. When prompted, pick a region and a Fly organization.

```bash theme={null}
flyctl launch --name myedgedb --image edgedb/edgedb --no-deploy
```

Since we're using `flyctl launch`, this will create a `fly.toml`. All `flyctl` commands will now be applied against our `myedgedb` application unless otherwise specified with `--app`.

EdgeDB needs more RAM than the default `256MB` so let's scale the RAM to `1024MB`.

```bash theme={null}
flyctl scale memory 1024
```

Set a password for the EdgeDB instance as a Fly secret. Keep track of this password; it won't be visible again.

```bash theme={null}
flyctl secrets set EDGEDB_PASSWORD=mysecretpassword
```

We need to configure a few other environment variables too.

```bash theme={null}
flyctl secrets set \
  EDGEDB_SERVER_BACKEND_DSN_ENV=DATABASE_URL \
  EDGEDB_SERVER_TLS_CERT_MODE=generate_self_signed \
  EDGEDB_SERVER_PORT=8080
```

Let's discuss what's going on with all these secrets.

* `EDGEDB_SERVER_BACKEND_DSN_ENV` tells EdgeDB which environment variable holds the Postgres connection string.
* `EDGEDB_SERVER_TLS_CERT_MODE` tells EdgeDB to auto-generate a self-signed TLS certificate.
  * You may instead choose to provision a custom TLS certificate. In this case, you should instead create two other secrets: assign your certificate to `EDGEDB_SERVER_TLS_CERT` and your private key to `EDGEDB_SERVER_TLS_KEY`.
* `EDGEDB_SERVER_PORT` tells EdgeDB to listen on port `8080` instead of the default 5656, as Fly uses `8080` for its default health checks.

## Attach and deploy

Let's attach `mypostgres` to `myedgedb`.

```bash theme={null}
flyctl postgres attach mypostgres
```

This sets the value of `DATABASE_URL` in the `myedgedb` app and creates a new role called `myedgedb` in our Postgres database. By default, this role doesn't have the full set of permissions EdgeDB needs to run. To change that, open a connection to your Postgres instance.

<CodeGroup>
  ```bash cmd theme={null}
  flyctl postgres connect --app mypostgres
  ```

  ```output output theme={null}
  Connecting to mypostgres.internal... complete
  psql (14.4 (Debian 14.4-1.pgdg110+1))
  Type "help" for help.

  postgres=# 
  ```
</CodeGroup>

Then run the following REPL command.

```
postgres=# alter role myedgedb createrole createdb;
ALTER ROLE
postgres=# \quit
```

Finally, our EdgeDB app is ready to deploy!

```bash theme={null}
flyctl deploy
```

It may take a few minutes to fully deploy. Debug with `flyctl logs` and check the deployment status with `flyctl status`.

```bash theme={null}
flyctl status
```

## Persist certificates

We need to persist the auto-generated TLS certificate to make sure it survives EdgeDB app restarts. (If you’ve provided your own certificate, skip this step.)

```bash theme={null}
flyctl ssh console \
  -C "edgedb-show-secrets.sh --format=toml EDGEDB_SERVER_TLS_KEY EDGEDB_SERVER_TLS_CERT" \
  | tr -d '\r' | flyctl secrets import
```

## Connection

You'll be able to connect to your EdgeDB instance using the following DSN from *other Fly.io apps* in the same organization:

`edgedb://edgedb:mysecretpassword@myedgedb.internal:8080`

To pass this DSN to another app, create a secret called `EDGEDB_DSN` containing this value. EdgeDB's client libraries will read this environment variable and connect to your instance automatically.

```bash theme={null}
flyctl secrets set \
  EDGEDB_DSN=edgedb://edgedb:mysecretpassword@myedgedb.internal:8080 \
  --app my-other-app
```

If you've [configured a Wireguard tunnel](/networking/private-networking) on your local machine, you'll be able to open a REPL to your new EdgeDB instance with the `edgedb` CLI.

<CodeGroup>
  ```bash cmd theme={null}
  edgedb --dsn edgedb://edgedb:mysecretpassword@myedgedb.internal:8080 --tls-security insecure
  ```

  ```output output theme={null}
  EdgeDB 2.x (repl 2.x.x)
  Type \help for help, \quit to quit.
  edgedb>
  ```
</CodeGroup>