The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
Deploy a production CockroachDB cluster on three separate Ubuntu hosts (or independent failure domains), give every node a unique address and storage directory, secure inter-node and client traffic with TLS certificates, start all nodes with the same join list, and run cockroach init exactly once. A three-node cluster started on one machine is suitable only for testing, not production.
What a three-node deployment should look like
CockroachDB distributes data and coordinates writes with Raft consensus. Three nodes allow the cluster to continue operating when one node is unavailable, provided the remaining nodes can communicate. That resilience depends on physical or virtual separation: use three Ubuntu servers or virtual machines in independent failure domains whenever possible. Cockroach Labs states that running multiple nodes on one host is useful for testing but is not suitable for production.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Each host needs:
- A consistent CockroachDB release and a controlled installation of the
cockroachbinary. - A stable DNS name or IP address that other nodes and clients can reach.
- A unique data-store directory.
- A unique SQL/RPC listening address, normally using port
26257. - A unique DB Console HTTP address, normally using port
8080. - Network access to the other nodes’ SQL/RPC and DB Console ports as required by your topology.
Use a three-address join list in a single-region deployment. Three to five join addresses are generally appropriate; this guide uses three.
| Node | Example DNS name | Store directory | SQL/RPC address | DB Console address |
|---|---|---|---|---|
| Node 1 | node1.example |
/var/lib/cockroach/data |
node1.example:26257 |
node1.example:8080 |
| Node 2 | node2.example |
/var/lib/cockroach/data |
node2.example:26257 |
node2.example:8080 |
| Node 3 | node3.example |
/var/lib/cockroach/data |
node3.example:26257 |
node3.example:8080 |
The names above are examples. Replace them with names and addresses resolvable from every node, client, and load balancer. Do not reuse one host’s store or listening address on another host.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
Choose the operating model before installing
| Decision | Option 1 | Option 2 | When each fits |
|---|---|---|---|
| Infrastructure | Self-managed Ubuntu servers or VMs | Managed CockroachDB Cloud | Self-management provides control over the operating system and process; a managed service removes much of the host and process administration. The exact cloud features and regions depend on the service offering. |
| Failure domains | Three separate hosts or zones | Several nodes on one host | Separate hosts are the production topology. Colocated nodes are a local test arrangement and do not provide host-failure resilience. |
| Certificate authority | CA generated for the cluster | Organizational or public PKI | A CockroachDB-generated CA is straightforward for a self-managed cluster. An existing PKI can fit enterprise certificate-issuance and rotation processes. |
| Process supervision | systemd or another service manager | Container or orchestration platform | A service manager is simple on dedicated Ubuntu hosts. An orchestrator is appropriate when your organization already standardizes deployment, health checks, and rollout automation there. |
This article covers a manually deployed, TLS-secured cluster on three Ubuntu hosts. The same addressing and certificate requirements still apply if you later automate the deployment.
Prepare the Ubuntu hosts
Use stable names and routable addresses
Create DNS records or otherwise configure name resolution so that node1.example, node2.example, and node3.example resolve correctly from all three hosts. Test both forward resolution and connectivity before starting CockroachDB. If clients will connect through a load balancer, record the load balancer names and addresses now; those names must also appear in the client-facing certificate SANs.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteInstall the same CockroachDB release everywhere
Install one CockroachDB release consistently on all three Ubuntu machines. Obtain the Linux package or archive, version information, and checksum instructions from CockroachDB’s current Linux installation documentation at implementation time, because release-specific package details change. Keep the binary and configuration under controlled administration rather than downloading an unverified copy separately on each host.
After installation, verify that the command is available on every machine and that all machines report the same release. A version mismatch can make troubleshooting and upgrades unnecessarily difficult, even when the process starts.
Create directories and protect ownership
Plan a certificate directory and a data directory on each host. The examples use /var/lib/cockroach/certs and /var/lib/cockroach/data. The account that runs CockroachDB must be able to read its certificates and write its store, while the CA private key should be kept in a separate, tightly protected location and should not be placed in the data directory.
Open only the traffic the topology needs
Permit node-to-node SQL/RPC traffic on port 26257 and DB Console access on port 8080 as required by your administration path. Restrict those ports with firewall rules or security groups to the node, administrator, and client networks that need them. Do not expose an insecure test cluster to a routable production network.
Free tools Windows power users keep installed
One-click scans. No signup required.
Create the TLS certificate hierarchy
A secure deployment needs a certificate authority (CA), node certificates, and client certificates. CockroachDB uses the CA to authenticate nodes and clients and to encrypt connections. Protect the CA private key as a signing secret; operators should not leave it broadly readable on every database host.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
Generate a CA and certificates
Run the certificate commands from a controlled administration workstation or another location where the CA key can be protected:
mkdir certs my-safe-directory
cockroach cert create-ca
--certs-dir=certs
--ca-key=my-safe-directory/ca.key
cockroach cert create-node node1.example node2.example node3.example
--certs-dir=certs
--ca-key=my-safe-directory/ca.key
cockroach cert create-client root
--certs-dir=certs
--ca-key=my-safe-directory/ca.keyThe node command shown is a starting point. In a real deployment, include every DNS name and IP address that may be used to reach each node, including names presented by a load balancer. Those values are written into the node certificate’s Subject Alternative Name (SAN) extension. If a client connects using a name that is absent from the SAN, TLS hostname verification can fail even though the node is otherwise healthy.
Understand the generated files
| File or role | Purpose | Where it belongs |
|---|---|---|
ca.crt |
Public certificate used to verify certificates signed by the cluster CA. | On nodes and clients that must trust the cluster. |
node.crt |
Certificate presented by a CockroachDB node. | On each node, with the corresponding private key. |
node.key |
Private key for the node certificate. | Only on the node that uses it; protect file permissions. |
client.node.crt and client.node.key |
Client identity for SQL and administrative connections. | On the client host or administration workstation that needs it. |
Copy only the files required by each host, preserve the expected filenames, and keep private keys confidential. The root client certificate is convenient for initial administration; create a separate SQL user and client identity for normal applications and operators.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Start the three nodes with a common join list
Start the process on each host with its own store and addresses, while keeping the --join value identical. The following command is the node 1 pattern:
cockroach start
--certs-dir=/var/lib/cockroach/certs
--store=/var/lib/cockroach/data
--listen-addr=node1.example:26257
--http-addr=node1.example:8080
--join=node1.example:26257,node2.example:26257,node3.example:26257Run the equivalent command on node 2 and node 3, replacing only the node-specific --listen-addr and --http-addr values. Keep each node’s --store unique to that host. The join list tells a new process where to find cluster members; it is not a list of alternative local stores.
What to check before initialization
- All three processes are running and using the intended certificate directory.
- Each host can resolve and reach the other two hosts on port
26257. - The certificate SANs cover the exact names or addresses used in the commands.
- No two processes point at the same data directory.
- The DB Console addresses are reachable from the administration network.
At this stage, the processes can discover one another, but the cluster has not yet been initialized.
Initialize the cluster once
After all three nodes are running and can communicate, initialize the cluster from any one join address:
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
cockroach init
--certs-dir=/var/lib/cockroach/certs
--host=node1.example:26257A successful command prints:
Cluster successfully initializedInitialization is a one-time operation for the cluster. Do not run cockroach init again after that message. If the command reports that the cluster is already initialized, stop and use SQL or the DB Console to inspect the existing cluster rather than attempting to initialize it again.
Verify SQL access, writes, and replication
Connect with the client certificate
cockroach sql
--certs-dir=/var/lib/cockroach/certs
--host=node1.example:26257The command uses the client certificate files in the specified certificate directory. If you are connecting from a separate workstation, use the directory containing ca.crt and the appropriate client certificate and key.
Perform a write/read check
Run a small, disposable test that exercises SQL writes and reads:
CREATE DATABASE appdb;
CREATE TABLE appdb.healthcheck (
id INT PRIMARY KEY,
note STRING
);
INSERT INTO appdb.healthcheck (id, note)
VALUES (1, 'three-node check');
SELECT * FROM appdb.healthcheck;Exit the first SQL session, connect to node 2 or node 3, and run the SELECT again. Every node can act as a SQL gateway, so the row should be readable through another node once the write has replicated. Remove the test database or table if it is not part of your application.
Recommended Free Tools
Inspect the DB Console
Open the DB Console over HTTPS using the node’s --http-addr. Confirm that all three nodes are live and that replica counts are consistent. Matching replica information is evidence that data is being replicated through Raft consensus. A console connection should use an administrative account with only the permissions required for the task.
Create a non-root administrative identity
Use the root client certificate for bootstrap work only. Create a non-root SQL user and grant the roles needed for console access and administration. Give application accounts the minimum database and table privileges they require, and keep administrative credentials separate from application credentials.
Optionally run a workload
A short representative workload can reveal network, disk, or latency problems that a single-row check will not. Run it only after the basic SQL and replication checks pass, and monitor node health while it runs. Do not treat a brief smoke test as a capacity benchmark.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
Run CockroachDB under systemd
For production, do not rely on an interactive shell or an unattended terminal session. Use a process manager such as systemd so the service starts predictably, restarts after an unexpected exit, and writes logs through the host’s normal logging path.
Create a unit on each host with the node-specific start command. This is a pattern; adapt the user, paths, and addresses to your installation:
[Unit]
Description=CockroachDB node
After=network-online.target
Wants=network-online.target
[Service]
User=cockroach
ExecStart=/usr/local/bin/cockroach start
--certs-dir=/var/lib/cockroach/certs
--store=/var/lib/cockroach/data
--listen-addr=node1.example:26257
--http-addr=node1.example:8080
--join=node1.example:26257,node2.example:26257,node3.example:26257
Restart=on-failure
[Install]
WantedBy=multi-user.targetUse the corresponding node name in the node 2 and node 3 units. After placing and validating the unit, reload systemd, enable the service for boot, start it, and inspect its status and logs. Keep the certificate and data directories readable and writable by the service account, while leaving the CA private key outside the service account’s routine access.
When changing addresses, certificates, or join members, update the unit and deployment records together. Restart one node at a time and verify cluster health before proceeding to the next node.
Production checklist
- Topology: Three separate Ubuntu hosts or failure domains; colocated nodes are not a production substitute.
- Version control: The same CockroachDB release installed and verified on every node.
- Naming: Stable DNS or IP addresses resolvable from nodes, clients, and any load balancer.
- TLS: CA, node, and client certificates deployed; every production DNS name and IP included in the relevant SANs.
- Secrets: CA and private keys protected with restricted ownership and backups handled as sensitive material.
- Networking: Required SQL/RPC and DB Console paths allowed, with unnecessary exposure blocked.
- Storage: A unique store per node and a monitored filesystem with sufficient capacity.
- Initialization:
cockroach initexecuted once, with the success message recorded. - Verification: SQL connection, write/read test through another node, and DB Console confirmation of three live nodes.
- Accounts: Root used for bootstrap; non-root users and least-privilege roles used for routine work.
- Operations: systemd or another manager configured for restart behavior and log handling.
- Monitoring: Follow CockroachDB’s production checklist and monitoring and alerting guidance for node health, replication, storage, and availability.
Troubleshooting common deployment failures
Nodes cannot join
Check DNS resolution from every host, confirm port 26257 is reachable in both directions, and compare the join list character for character. A firewall that permits client SQL traffic but blocks node-to-node traffic will prevent a healthy cluster from forming.
TLS hostname verification fails
Compare the address in the client command or join list with the node certificate SANs. Add every DNS name, IP address, and load-balancer name that clients actually use, then replace the certificate on the affected node. Changing only DNS does not add a name to an existing certificate.
cockroach init says the cluster is already initialized
The cluster has already completed initialization. Do not repeat the command; connect with cockroach sql or open the DB Console and inspect node and replication status.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
SQL connects to one node but not another
Verify that the second node’s SQL/RPC address is reachable, its certificate covers the exact hostname, and its process is using the intended certificate and store directories. Then inspect the DB Console for node liveness and replica status.
A node starts with an unexpected or empty store
Inspect the systemd ExecStart line and confirm the --store path. A typo or permission problem can direct the process to a different location. Stop the service before changing paths, and never point two live nodes at the same store.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsThe process stops after a terminal closes
Move the start command into systemd or another process manager. An interactive shell is not a production supervisor and does not provide reliable restart or boot behavior.
Scaling and availability considerations
A three-node cluster is the minimum topology described here, not a guarantee that every failure scenario is harmless. Its benefit comes from independent hosts, working network paths, healthy storage, and correctly replicated ranges. Place nodes so that one host or failure domain can be lost without taking down the majority needed for consensus.
Adding a load balancer can simplify client addressing, but the names and addresses presented by that load balancer must be included in certificates. Keep direct node addresses available for administration and diagnosis even when applications use a shared endpoint.
Plan certificate rotation, binary upgrades, backups, alert ownership, and restore testing before the cluster carries important data. These operational procedures are separate from the initial bootstrap and should be documented for the people who will operate the service.
Final deployment sequence
- Provision three Ubuntu hosts in separate failure domains and assign stable names.
- Install and verify the same CockroachDB release on all hosts.
- Prepare protected certificate and data directories and the required firewall paths.
- Create the CA, node certificates, and client certificates, including all production SANs.
- Copy the appropriate certificates to each host and verify ownership and permissions.
- Start each node with a unique store and listen/HTTP address and the same three-address join list.
- Run
cockroach initonce against any join address and confirm the success message. - Connect with SQL, perform a write/read check through another node, and inspect the DB Console.
- Create non-root users and least-privilege roles for routine administration and applications.
- Move the process under systemd, configure restart and logs, and apply monitoring and production runbooks.
This sequence produces a secure, verifiable three-node CockroachDB cluster on Ubuntu while keeping the production distinction clear: separate hosts and protected TLS credentials are essential, not optional refinements.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
