Recommended Free Tools
To self-host Drizzle Gateway, run Drizzle’s Gateway container on your VPS, persist /app in a Docker volume, set a strong MASTERPASS, and expose the interface only through HTTPS or a private network such as Tailscale. The smallest working deployment is one container, one persistent volume, port 4983, and a master password.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Gateway is the remote, self-hosted form of Drizzle Studio. Drizzle positions drizzle-kit studio for local development; its hosted Studio is not intended to be exposed on a remote machine, while Gateway is designed for that use. Gateway stores database connections in persistent storage, supports team sharing, and uses a master password plus per-user passcodes.
As an Amazon Associate I earn from qualifying purchases.
What Drizzle Gateway does
Drizzle Gateway provides a web interface for connecting to and managing databases from a remote server. It is described by Drizzle as “a free self-hosted Drizzle Studio on steroids.” Instead of running a development-only Studio process on your laptop, you keep Gateway running on a VPS and reach it from a browser.
The distinction matters operationally:
drizzle-kit studiois positioned for local development.- The hosted version of Studio is intended for local development rather than exposure on a remote machine.
- Gateway is the remote/self-hosted option. It stores saved connections in persistent storage and adds team-oriented access controls.
A VPS deployment does not make a database public by itself. Gateway still needs network access to each database, and your firewall, database allow-list, private network, or tunnel must permit that traffic.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
What you need before deployment
- A VPS running a Linux distribution supported by Docker Engine.
- Docker Engine installed and able to run containers as the account you will use for deployment.
- A DNS name if you plan to publish Gateway through HTTPS.
- A long, unique master password. Treat it as a secret, not as a value to paste into shell history or commit to a repository.
- A plan for persistent storage and backups. Gateway’s saved connections and configuration live in its storage path.
- A network design: public HTTPS through a reverse proxy, or private access through an overlay network such as Tailscale.
Drizzle’s image supports both ARM and AMD architectures, so you can use the same image on common x86-64 and ARM VPS instances. The supplied deployment material does not specify a minimum CPU, memory, disk size, or a particular VPS vendor; size the machine for the number of users, database connections, and any other services sharing it.
Choose the network shape first
Private-only access
The safest arrangement is to keep Gateway off the public internet. Bind the container to the VPS loopback address or a private interface, then reach it through a private overlay network. Drizzle’s Tailscale pattern uses a private domain, can optionally forward database traffic, and removes the public domain so Gateway is reachable only through the tailnet.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
This approach reduces exposure to password guessing and internet-wide scanning. Every person who needs access must be on the private network, and the VPS firewall should still allow only the administration and private-network traffic you actually need.
Public HTTPS through a reverse proxy
If users need access from ordinary internet connections, place a TLS-terminating reverse proxy in front of Gateway. Let the proxy handle the public HTTPS listener and forward requests to Gateway on the VPS. Add rate limiting at that edge and keep Gateway’s container port private to the host or private network.
Do not treat port 4983 as an alternative to HTTPS. A direct public listener is an unnecessary exposure of the administration interface. Use a strong master password, per-user passcodes, encrypted transport, and firewall rules together.
Install Docker and prepare the VPS
- Install Docker Engine using the instructions for your VPS operating system.
- Confirm that Docker responds with
docker versionand that your account can run a test container. - Configure the host firewall so only the ports required for administration, HTTPS, or your private overlay network are reachable.
- Decide whether a reverse proxy or private tunnel will terminate access. If so, plan to bind Gateway to loopback rather than all host interfaces.
Keep the VPS operating system, Docker Engine, and any reverse-proxy software maintained. Gateway is an administrative surface, so a neglected host can undermine otherwise correct application settings.
Run the smallest Docker deployment
Drizzle’s quick-start sequence pulls the image, creates a named volume, and starts the container on port 4983:
docker pull ghcr.io/drizzle-team/gateway:latest
docker volume create drizzle-gateway
docker run -d
--name drizzle-gateway
--restart always
-p 4983:4983
-e PORT=4983
-e MASTERPASS=your_master_password
-v drizzle-gateway:/app
ghcr.io/drizzle-team/gateway:latestReplace your_master_password with a long secret. The service is available at http://localhost:4983 when the command is run on the host. If you bind port 4983 to a public interface, the service may be reachable from the internet, so use a private binding or a TLS proxy for a real deployment.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Use a protected environment file
Putting a password directly in a command can leave it in shell history and process inspection output. Docker supports -e, --env, and --env-file for passing environment variables into a container. A protected environment file is easier to rotate and keeps the command itself free of credentials.
sudo install -d -m 700 /etc/drizzle-gateway
sudo sh -c 'cat > /etc/drizzle-gateway/gateway.env' <<'EOF'
PORT=4983
MASTERPASS=replace-with-a-long-random-secret
STORE_PATH=/app
EOF
sudo chmod 600 /etc/drizzle-gateway/gateway.envStart Gateway with the file and explicitly set the storage path:
docker run -d
--name drizzle-gateway
--restart always
-p 127.0.0.1:4983:4983
--env-file /etc/drizzle-gateway/gateway.env
-v drizzle-gateway:/app
ghcr.io/drizzle-team/gateway:latestThe 127.0.0.1:4983:4983 binding keeps the port on the VPS itself. A reverse proxy on the same host can forward to it, while a private-network design can use an appropriate private interface instead.
Make persistence work across restarts
The volume mount and STORE_PATH must refer to the same location. Mounting a volume at /app while Gateway writes somewhere else can make the interface appear to work until the container is recreated; saved connections then seem to disappear.
Use an absolute storage path:
STORE_PATH=/appThe standalone deployment reference warns that a relative path can resolve against the image’s working directory instead of the mounted volume. That is why the hardened command sets STORE_PATH=/app explicitly.
Named volume
A named volume is the simplest option:
docker volume create drizzle-gateway
docker volume inspect drizzle-gatewayDocker manages the volume location, and the container mounts it at /app. Keep the volume name unchanged when replacing the container.
Bind mount
A bind mount stores the files at a path you choose on the VPS:
sudo install -d -m 700 /srv/drizzle-gateway
docker run -d
--name drizzle-gateway
--restart always
-p 127.0.0.1:4983:4983
--env-file /etc/drizzle-gateway/gateway.env
-v /srv/drizzle-gateway:/app
ghcr.io/drizzle-team/gateway:latestBind mounts make host-level backup tools and disk monitoring straightforward, but you must manage the directory’s permissions, ownership, capacity, and accidental deletion yourself. Do not switch between a named volume and a bind mount without copying the existing data; each mount presents a different storage location.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Register databases at first boot
You can pre-register connections with environment variables named DATABASE_URL_<name>. For example:
DATABASE_URL_Production=postgres://user:[email protected]:5432/app
DATABASE_URL_Analytics=postgres://user:[email protected]:5432/warehousePlace these variables in the protected environment file before the first start. The values contain database credentials, so protect the file like the master password and avoid posting them in tickets, logs, screenshots, or shell history.
Free tools Windows power users keep installed
One-click scans. No signup required.
The suffix becomes the connection name shown in Gateway. Choose stable, descriptive names such as Production or Analytics; changing a variable name later can create a new entry rather than renaming an existing one, depending on how the application reconciles startup configuration.
Add a connection in the UI instead
Start Gateway, sign in with the master password, and use the interface’s connection controls to enter a database URL. This is useful when the URL should not be present in the container environment, or when an administrator needs to add a connection after the initial deployment.
Whichever method you use, verify the database is reachable from the VPS. A URL that works from your laptop may fail from the server because of firewall rules, private DNS, an allow-list, TLS requirements, or a database that accepts connections only from a local network.
Verify the first deployment
- Check that the container is running with
docker ps. - Review startup output with
docker logs drizzle-gateway. - From the VPS, open
http://localhost:4983or query it through the private interface you selected. - Sign in with the master password and create a per-user passcode for each person who needs access.
- Open one test database connection and confirm that schemas or tables load as expected.
- Restart the container with
docker restart drizzle-gateway, sign in again, and confirm that the saved connection remains.
That restart test checks the most common persistence mistake: a working container whose configuration was written outside the mounted storage path.
Protect Gateway before allowing remote access
Authentication
Set MASTERPASS to a unique, high-entropy secret. Gateway also supports per-user passcodes, so do not share the master password as a team login. Give each user an individual passcode and remove access when a person no longer needs it.
Transport encryption
Use HTTPS whenever traffic leaves the VPS or a trusted private network. Terminate TLS in a reverse proxy or use the private-network pattern. Do not send the master password over an unencrypted public connection.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Firewall and binding
Expose only the ports required for your design. With a same-host reverse proxy, publish HTTPS at the proxy and bind Gateway to 127.0.0.1:4983. With a private overlay network, bind to the appropriate private interface and avoid a public listener. The exact firewall rules depend on your operating system and network provider; Drizzle does not prescribe a particular VPS vendor or rule set.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Database-side controls
Protecting the Gateway page does not replace database authentication. Keep database credentials least-privileged, restrict database inbound rules to the VPS or private network where possible, and use encrypted database connections when the database supports them.
Back up the Gateway volume
The Docker volume contains Gateway configuration and saved connections, so include it in your VPS backup plan. A backup that covers only the operating system but not the volume will not restore the connection catalog.
Back up a named volume
One practical method is to create a temporary container that archives the volume:
docker run --rm
-v drizzle-gateway:/source:ro
-v "$PWD":/backup
alpine tar czf /backup/drizzle-gateway-backup.tgz -C /source .Store the resulting archive somewhere separate from the VPS and protect it because it may include connection details. Test restoration on a separate volume before relying on the backup.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesBack up a bind mount
For a bind mount, back up the directory used as /app, such as /srv/drizzle-gateway. Stop Gateway briefly if your backup method cannot guarantee a consistent snapshot while files are changing. Keep multiple generations and document where the master-password material is stored; a volume backup without the required secret may not be sufficient for recovery.
Update Gateway without losing connections
The image name uses the latest tag in Drizzle’s quick start. Before an update, back up the volume and record the current container configuration. Pull the new image, then recreate the container with the same volume and environment settings:
docker pull ghcr.io/drizzle-team/gateway:latest
docker stop drizzle-gateway
docker rm drizzle-gateway
docker run -d
--name drizzle-gateway
--restart always
-p 127.0.0.1:4983:4983
--env-file /etc/drizzle-gateway/gateway.env
-v drizzle-gateway:/app
ghcr.io/drizzle-team/gateway:latestDo not remove the volume while replacing the container. If the new image behaves unexpectedly, stop it, restore the prior image tag if you recorded one, and attach the same volume. Validate the login page and a test connection after every update.
Deployment choices compared
| Decision | Option | When it fits |
|---|---|---|
| Internet exposure | Public HTTPS through a reverse proxy | Users need access from ordinary internet connections; TLS and rate limiting are handled at the edge. |
| Internet exposure | Private tailnet access | All users can join a private overlay network and public reachability is undesirable. |
| Storage | Named Docker volume | You want the shortest Docker setup and will back up the volume through Docker-aware tooling. |
| Storage | Bind mount | You want Gateway files at a known host path for existing backup and disk-management processes. |
| Deployment location | Manual Docker VPS | You control the host, firewall, network path, volume, and update process. |
| Deployment location | Managed Railway deployment | You prefer a managed platform’s deployment workflow and accept its platform-specific storage and networking model. |
| Connection setup | DATABASE_URL_<name> at first boot |
You want known connections available immediately and can protect the environment file. |
| Connection setup | Gateway UI | You need to add or change connections interactively after deployment. |
| CPU architecture | AMD or ARM | The published image supports both architecture families. |
Troubleshooting common failures
The container starts, but connections disappear after a restart
Check that the volume is mounted at /app and that STORE_PATH=/app is set. Inspect the container configuration and confirm you did not accidentally start a replacement container with a different volume name or host path. Restore the previous volume if you changed mounts during an update.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →The login page is unreachable
Confirm the process with docker ps, inspect docker logs drizzle-gateway, and verify the port binding. If Gateway is bound to 127.0.0.1, it will not answer directly on the VPS’s public address; access it through the reverse proxy or private network you configured. Check firewall rules and DNS separately.
A database URL works locally but not from Gateway
Test name resolution and network reachability from the VPS. Check the database’s inbound allow-list, private-network routing, port, credentials, and TLS settings. The relevant network path is from the Gateway host to the database, not from your workstation.
Pre-registered connections do not appear
Verify the variable names use the DATABASE_URL_<name> pattern, that the environment file was supplied to the container, and that the values were present on the first start. Inspect logs without exposing the full URLs, since they contain credentials. If you later change only the environment file, recreate the container so Docker passes the updated variables.
The image will not run on the VPS
Check the VPS architecture and Docker’s image-pull error. Gateway’s image supports ARM and AMD architectures, but a malformed platform configuration, an outdated Docker installation, or a host that cannot reach the registry can still prevent startup.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallHTTPS works, but the application behaves incorrectly behind the proxy
Confirm that the proxy forwards requests to the local Gateway listener, preserves the host and scheme information expected by the application, and does not expose the backend port separately. Review proxy logs and Gateway logs together while making a test request.
When a VPS is the right choice
A VPS gives you direct control over Docker, storage, firewall rules, DNS, backups, and private networking. That control is useful when Gateway must reach databases inside a specific network or when your team needs a predictable self-hosted endpoint.
The trade-off is operational responsibility. You must patch the host, protect the secrets, monitor storage, renew or automate TLS at the proxy, maintain backups, and test recovery. A managed deployment can reduce host maintenance, but you still need to understand its persistent-storage and network behavior before relying on it for saved connections.
Quick Recap
Recommended production sequence
- Install Docker Engine and restrict the VPS firewall.
- Create the
drizzle-gatewayvolume or a dedicated bind-mount directory. - Create a mode-600 environment file containing
MASTERPASS,PORT=4983, andSTORE_PATH=/app. - Pull
ghcr.io/drizzle-team/gateway:latest. - Start the container with
--restart always, mount storage at/app, and bind port 4983 privately when a proxy or tunnel will handle access. - Choose either HTTPS through a reverse proxy or private access through a tailnet; do not publish an unprotected Gateway port.
- Sign in, create per-user passcodes, and test one database connection from the VPS.
- Restart the container and verify that the connection remains.
- Back up the volume and document the restore procedure before adding production databases.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problems
