Developer VPN

Developer VPN lets a laptop reach private addresses in a managed WireGuard cluster. Each person has an access grant, and each device has its own WireGuard configuration and key.

Only allowed private networks are routed through the VPN. Your normal internet traffic keeps using your normal connection. Upvale does not generate a full-internet VPN configuration.

Give a developer database access

The short path is:

1. Use a cluster created with Managed WireGuard networking.
2. Invite the developer into your organization with a role that includes Connect to developer VPN.
3. Open Fleet → cluster → Developer VPN → Connection and set up a gateway.
4. Under People & access, create a database-specific access rule and give the developer access to it.
5. The developer opens Profile → My VPN access, creates a device, downloads Config, and imports it into WireGuard.
6. Publish the database endpoint on an allowed private address and connect using the database credentials.

The sections below cover the settings and the database connection step in detail.

Permissions and team membership

There are two permissions:

A developer does not need application, database-management, infrastructure, or team-management permissions just to connect. Create a limited role under Settings → Roles, invite the developer under Members, and assign that role. They still need an Upvale account and organization membership; anonymous VPN users are not a separate feature. See Team and access.

Permission to connect is not a cluster grant. A VPN manager must also add the person under the selected cluster's People & access. Database usernames and passwords remain separate from VPN access.

Set up the connection

1. Open Fleet → cluster → Developer VPN → Connection.
2. Select Set up VPN.
3. Choose a VPN node from this cluster.
4. Enter its reachable Server address, such as vpn.example.com or its public IP.
5. Allow the displayed public UDP port in the provider firewall.
6. Select Set up VPN and wait for the connection to become ready.

The VPN gateway runs on the selected node. It connects developer devices to allowed networks through the cluster mesh; it is separate from the node-to-node WireGuard mesh itself.

Connection settings

Edit settings changes the existing gateway's address, ports, DNS, and MTU. Changes can require users to download and reimport their configuration.

The connection card shows its status, server address, device address range, and count of people with access. Advanced connection settings also shows the node's reported listener firewall state. That host state does not prove the provider firewall is open.

Disable VPN stops all device connections while keeping the connection settings. Enable VPN restores it. Remove VPN is available after disabling; it removes the connection and erases its device keys and configurations. Old files will no longer work.

People and access rules

Open Developer VPN → People & access.

Give someone access

1. Select Add person.
2. Choose a Person who has the Connect to developer VPN permission.
3. Select Access to. Cluster network is the included default rule; custom rules can narrow access to a host and port.
4. Set Expires for temporary access, or leave it blank for no expiry.
5. Select Give access.

The table shows each person's assigned access rule, status, and expiry. Disable suspends the grant; Enable restores it. Revoke permanently removes the person's device keys and configurations. Create new devices if they receive access again.

Limit access to a database

The default Cluster network rule allows traffic to the mesh range. For narrower access:

1. Expand Custom access rules and select Add rule.
2. Name it, for example Development PostgreSQL.
3. Choose Specific address or range and enter the database endpoint's mesh address with /32, such as 10.10.0.5/32.
4. Set Traffic to TCP.
5. Set Port to the port published for the database, for example 15432.
6. Keep Traffic direction as From devices to the network.
7. Save the rule and select it when adding the person.

Use the published endpoint port, which may differ from the database's container port. For example, a PostgreSQL container listening on 5432 may be published on 15432.

Every rule option

A disabled access rule no longer authorizes its traffic. Deleting a custom rule removes the access it allowed; the included default rule can be disabled but is not deleted through this screen.

The access rule enforces what may cross the gateway. A client's VPN routes controls what the laptop sends into the tunnel. Adding a route does not grant access that the rule denies.

Create and download a device

From your profile

1. Open Profile → My VPN access.
2. Under Cluster access, check that the grant for your cluster is active.
3. Under Create a device, choose Cluster and enter a Device name, such as Work laptop.
4. Leave the other fields at their defaults for a normal connection.
5. Create the device and wait for its address to be assigned.
6. In My devices, select Config to download its .conf file, or QR to import it with a WireGuard client that supports QR scanning.
7. Import and activate the tunnel in your WireGuard client.

The file already contains the device private key, device address, gateway public key, endpoint, and allowed routes. Treat the file and QR code as credentials. Use separate devices for separate laptops instead of sharing one file.

From the cluster

A VPN manager can use Developer VPN → Devices → Add device to create a device for a person with an active grant. This also allows a fixed address and an expiry.

DNS settings and traffic routing are separate. Setting a DNS server may change how the WireGuard client resolves names while connected, even though ordinary internet traffic still uses the normal route. Leave DNS blank unless you need a particular resolver.

Device status and changes

The cluster device list shows the owner, assigned address, activity, uploaded/downloaded bytes, and configuration details. Open Edit to change settings or disable, enable, or permanently revoke a device.

An active device is authorized; activity reports whether a recent handshake has been seen. A laptop can be authorized but currently disconnected.

If Configuration changed appears, download and reimport it. A local WireGuard configuration does not update itself after settings change in Upvale. Revocation deletes the stored private key and configuration and prevents the old file from being used to reconnect.

Connect to a database

VPN access routes packets to reachable addresses; it does not expose Docker's internal DNS or publish an internal-only database automatically.

For a single-node database:

1. Open the database's Connection tab.
2. Under External access, set an available port and save, then deploy the database change. The UI calls this an external port because it is published on the node, outside the container network.
3. Keep that port closed to the public internet in your provider firewall.
4. Find the storage node's mesh address in its details. For an ephemeral Redis database, use its runtime node.
5. Grant TCP access to that mesh address and the published port.
6. Connect the VPN, then use that address, published port, and the database's credentials in your database client.

For example, a client might connect to mesh host 10.10.0.5, port 15432, database app, and the username/password shown in Upvale. Use the PostgreSQL TLS settings and CA offered by the database connection screen where applicable.

For HA PostgreSQL, use a stable endpoint that reaches its published database proxy and include the necessary endpoint addresses in the access rule. One member's IP alone does not provide an automatically moving external endpoint. Use the database's external-host and connection guidance in Databases.

The managed read-only connection is an internal endpoint. It is not automatically published to a developer laptop when VPN access is enabled.

Reach other private networks

People & access → Other networks registers private networks beyond the mesh. Enter a name, CIDR, and optional description.

Adding a network does not create routing at a provider or remote router. The VPN gateway needs a route to it and IP forwarding; the destination network needs a return route to the VPN device range. Then add an access rule for the traffic you want to allow.

Under Devices → Networks behind devices, you can register a subnet reached through a WireGuard device. Choose the device and enter its address range. That device must forward IP traffic and route to the subnet. Access rules still apply. This is useful for a routed office or development network, not needed for a normal laptop connection.

Keep these ranges separate from mesh addresses, device addresses, Docker networks, and other registered routes.

Troubleshooting