Mastra Platform Adds VPC-Isolated Postgres for Network-Restricted Databases
Mastra has added VPC-isolated Postgres to its platform, allowing teams to attach a database to any environment that can only be reached from resources on the same network. According to Mastra, hosted databases are typically accessible from any client, and the VPC option adds a layer of security by blocking access from outside the network.
- Mastra platform can now attach a VPC-isolated Postgres database to any environment.
- VPC databases cannot be reached from outside the network, so psql connections from elsewhere fail.
- Requires Mastra CLI [email protected] or later; setup via mastra env db create production --kind postgres.
- The platform injects DATABASE_URL at deploy time, so existing PostgresStore config stays the same.
- Mastra says MongoDB and Redis are coming soon, following Turso and Neon launched in June.
What the new option does
Mastra says users can now attach a VPC-isolated Postgres database to any environment on the Mastra platform. The aim is to restrict access to resources on the same network. A regular hosted database can be reached by any client, while the VPC variant rejects connections from resources hosted outside the network.
The feature extends the managed database lineup. According to Mastra, it launched managed databases with Turso and Neon in June. VPC Postgres joins them for use cases where extra restrictions are required. The company says MongoDB and Redis are coming soon.
One practical detail concerns regions. When a VPC-provisioned database is used, the --region option does not apply. The platform deploys the database to the same region as the environment, so that it uses the same server network.
How to set it up
The feature requires the global Mastra CLI at version [email protected] or later, which Mastra says was added in PR #25650. Users install or upgrade it with npm install -g mastra@latest.
There are two ways to provision the database:
- Run mastra env db create production --kind postgres to attach a database to an environment directly.
- Leave DATABASE_URL unset in the .env file and let the preflight checks run at the next deploy. The CLI asks which managed database should be provisioned and offers Neon (serverless, public), Postgres (VPC-isolated), or the option to skip and set it manually later.
The platform injects DATABASE_URL at deploy time, so an existing PostgresStore configuration can stay unchanged. In Mastra's example, the store is created from the @mastra/pg package with a connectionString taken from process.env.DATABASE_URL.
Checking database status
Because of the isolation, a VPC database cannot be reached from outside the network. Mastra shows that trying to connect with psql returns an error saying the host name, which ends in railway.internal, could not be translated to an address.
To inspect a database, users run mastra env db show followed by the database name. A status of ready means the database is provisioned and attached. The command mastra env db list reports the same for every database in the project and shows which environment each one is attached to.
Mastra's example output lists the database type, ID, status, scope, region (us) and creation time. It also notes that connection environment variables are injected automatically at deploy time. DATABASE_URL is masked by default and can be revealed with the --show-secrets flag.
What it means for users
For teams building on Mastra platform, the change offers a way to keep a production Postgres database off the public internet without changing application code, since the connection string is still supplied through DATABASE_URL. Those who prefer a publicly reachable serverless database can still choose Neon during the same preflight prompt. Mastra points to its documentation on hosted databases, deploy environments and the CLI reference pages for full configuration options.
