Own your database infrastructure.
evdb turns a Linux server into a platform for Postgres and Redis-compatible databases.
It manages the infrastructure around them:
- Docker-based database services
- TLS routing and generated credentials
- Health checks and lifecycle operations
- Automatic Restic backups through your rclone remote
evdb requires a Linux server with systemd and root access. Ubuntu is the tested path. Native database
connections use ports 5432 and 6379, which must be free on the host and reachable by your clients.
Install these prerequisites using their official instructions:
- Docker Engine with the Docker Compose plugin
- Restic 0.17 or newer at
/usr/bin/restic - rclone at
/usr/bin/rclone
You also need a domain managed by a DNS provider supported by Traefik's DNS challenge and remote storage supported by rclone.
Choose a host ID and base domain. For a host ID of example-01 and a base domain of
storage.example.com, arrange for *.example-01.storage.example.com to resolve to the server from
your clients. evdb uses DNS-01 to issue certificates but does not create DNS records.
Create a private file containing the environment variables Traefik requires for your DNS provider,
one KEY=VALUE per line. Keep its path for initialization.
Configure your backup remote as the normal non-root user who will own remote access:
rclone config
rclone config file
rclone lsd remote:Replace remote with the configured remote name. Set the reported rclone configuration file to mode
0600; evdb requires its absolute path and uses it without copying it. A typical Restic repository is
rclone:remote:evdb/example-01.
Install the latest standalone release:
curl -fsSL https://github.com/evannotfound/evdb/releases/latest/download/install.sh | sudo shThe installer verifies the downloaded executable and installs it at /usr/local/bin/evdb.
Start guided initialization:
sudo evdb initEnter the host ID, base domain, ACME email, Traefik DNS provider name, Restic repository, DNS credential file, and absolute rclone configuration path prepared above. Leave the initial Restic password blank to generate one.
Initialization stores configuration under /etc/evdb, managed data under /var/lib/evdb, starts the
TLS router, initializes the Restic repository, and enables automatic daily backups.
Project names must end in -dev-N, -test-N, or -prod-N. Create Postgres and retrieve its
TLS-secured connection URL:
sudo evdb database add notes-prod-01 postgres
sudo evdb database info notes-prod-01/postgrespostgresql://default:<password>@notes-prod-01.example-01.storage.example.com:5432/postgres?sslmode=require
Use the URL with any standard Postgres client. database info prints complete credentials and
therefore requires a terminal.
Run sudo evdb for the guided terminal interface. Direct commands execute immediately and are useful
for scripts and SSH. Use --help at any command level, such as
sudo evdb database configure --help, for all available options.
sudo evdb status
sudo evdb status --json
sudo evdb database list
sudo evdb database add cache-prod-01 kv
sudo evdb database add cache-prod-02 kv --engine redis
sudo evdb database info cache-prod-01/kv
sudo evdb database configure notes-prod-01/postgres --max-clients 200
sudo evdb database start notes-prod-01/postgres
sudo evdb database stop notes-prod-01/postgres
sudo evdb database restart notes-prod-01/postgres
sudo evdb database logs notes-prod-01/postgres --lines 200
sudo evdb backup create notes-prod-01/postgres
sudo evdb backup create --all
sudo evdb backup list notes-prod-01/postgresRerun the installer to update evdb. On a configured host it also refreshes the managed router and backup timer without restarting healthy databases.
The automatic timer backs up every durable database sequentially. A backup succeeds only after the database files are checked and Restic confirms the remote snapshot.
evdb does not delete remote snapshots, so configure retention separately. Recovery is manual with Restic and the matching database tools; evdb does not provide a restore command.
Development uses Python and uv; installed hosts require neither.
uv sync --locked
make check
make binary