Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Run Drizzle Gateway as a Docker container on your VPS, attach a persistent volume at /app, set an absolute STORE_PATH=/app, and protect the service with MASTERPASS. Keep port 4983 private behind HTTPS or a tailnet unless you have deliberately configured a secure public edge. The smallest reliable installation is one container, one persistent volume, port 4983, and a strong master password.
What Drizzle Gateway is and why a VPS deployment is useful
Drizzle Gateway is the remote, self-hosted form of Drizzle Studio. Drizzle describes it as “a free self-hosted Drizzle Studio on steroids.” It connects to databases, saves connection configuration in persistent storage, supports team sharing, and protects access with a master password and per-user passcodes.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →This is different from drizzle-kit studio, which is positioned for local development. Drizzle says the hosted version of Studio is intended for local development and is not meant to be exposed on a remote machine; Gateway is the service intended for that remote use case. A VPS gives you an always-on host that your team can reach without leaving a developer workstation running.
A VPS deployment does not make a database public by itself. Gateway is an application layer that needs network access to each database you register. You still need to allow the VPS to reach the database host, use the correct TLS and firewall settings for that database, and limit who can reach Gateway.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
Choose the access and deployment model first
Decide whether Gateway should be reachable from the public internet or only from a private network before starting the container. This choice determines how you bind port 4983 and where TLS is terminated.
| Approach | Network exposure | When it fits | Important setup point |
|---|---|---|---|
| Private tailnet | Gateway is reachable only through a private overlay network | Internal teams, administration, or databases that should never have a public control panel | Use a private DNS name or tailnet address; Drizzle’s Tailscale pattern removes the public domain so the service is available only through the tailnet. |
| HTTPS reverse proxy | The proxy accepts HTTPS; Gateway listens on a private host address | Teams that need a normal browser URL and managed certificates | Bind the container to localhost or a private interface, then forward the proxy’s traffic to port 4983 and apply authentication-related rate limits at the edge. |
| Direct public port | Port 4983 is exposed directly on the VPS | Short-lived testing only, or an environment with an independent security boundary | Do not treat the master password as a substitute for TLS, firewall rules, or rate limiting. |
For most production installations, use either a private tailnet or an HTTPS reverse proxy. The official quick-start command publishes port 4983 on the host for convenience; adapt that mapping when the service must stay private.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Requirements and preparation
VPS and operating-system prerequisites
- A VPS running a Linux distribution supported by Docker Engine.
- Docker Engine installed and the Docker daemon enabled.
- Administrative access for creating the volume, starting the container, and configuring the host firewall.
- Network reachability from the VPS to every database you will register.
- A DNS name if you will use an HTTPS proxy, or a private DNS/tailnet name for internal access.
- A backup destination for the Docker volume, because it contains Gateway configuration and saved connections.
Install Docker using the instructions for your Linux distribution, then verify the installation with docker version and docker run --rm hello-world. Keep the host firewall closed to every port except those required for administration and your chosen access path. If a reverse proxy or tunnel terminates public traffic, Gateway itself does not need to be exposed on a public interface.
Create and protect a master password
MASTERPASS is the first barrier to the Gateway interface. Use a long, unique secret generated for this service; do not reuse a database password or a VPS login password. Avoid placing the secret directly in a command that will remain in shell history. Docker supports -e, --env, and --env-file for passing variables into a container, so a protected environment file is the practical option for a small VPS.
sudo install -m 600 /dev/null /etc/drizzle-gateway.env
sudo sh -c 'cat > /etc/drizzle-gateway.env' <<'EOF'
MASTERPASS=replace-with-a-long-unique-secret
PORT=4983
STORE_PATH=/app
EOFReplace the example value before starting the service. If you add database URLs to this file, treat the file as a credentials store: restrict its ownership and permissions, avoid committing it to source control, and include it in your secret-rotation process.
Deploy Drizzle Gateway with Docker
Official quick-start form
Drizzle’s official quick start uses the following sequence. It creates a named volume, downloads the Gateway image, and starts the container with automatic restarts:
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsRank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
docker pull ghcr.io/drizzle-team/gateway:latest
docker volume create drizzle-gateway
docker run -d
--name drizzle-gateway
--restart always
-p 4983:4983
-e PORT=4983
-e MASTERPASS=your_master_password
-v drizzle-gateway:/app
ghcr.io/drizzle-team/gateway:latestAfter the container starts, the service is available at http://localhost:4983 when requested from the Docker host. The image supports both arm and amd architectures. Drizzle also publishes standalone binaries for macOS and Linux, but Docker is the simplest repeatable VPS installation.
The command above is a convenient baseline, not a complete internet-facing security design. It publishes the port on all host interfaces and puts the password in the shell command. Use the protected environment-file form below when deploying a persistent service.
Persistent deployment with an environment file
First create the volume, then run the container with STORE_PATH=/app explicitly set:
docker pull ghcr.io/drizzle-team/gateway:latest
docker volume create drizzle-gateway
docker run -d
--name drizzle-gateway
--restart always
--env-file /etc/drizzle-gateway.env
-p 127.0.0.1:4983:4983
-v drizzle-gateway:/app
ghcr.io/drizzle-team/gateway:latestThis version keeps Gateway on the VPS loopback address. A reverse proxy running on the same host can forward HTTPS requests to 127.0.0.1:4983. If a private overlay network connects directly to the VPS, bind the port to the private interface instead of publishing it on every interface. Use -p 4983:4983 only when your firewall and edge design intentionally permit that exposure.
The named volume is mounted at /app, and STORE_PATH points to that same absolute location. This pairing is the critical persistence setting: Gateway writes its saved configuration and connections under the store path, while Docker keeps the mounted volume across container replacement and host restarts.
Check that the container is healthy
- Confirm that Docker reports the container as running:
docker ps --filter name=drizzle-gateway. - Read startup output if the container exits or repeatedly restarts:
docker logs --tail 200 drizzle-gateway. - Check the published port from the VPS itself:
curl -I http://127.0.0.1:4983. A response from the service confirms that the HTTP listener is reachable; it does not replace an end-to-end browser login test. - Open the hostname or private address you selected, sign in with the master password, and confirm that the Gateway interface loads.
- Create a test database connection and verify that the VPS can reach that database before importing production connections.
Make persistence survive restarts and upgrades
Why the volume mount and STORE_PATH must match
The Railway deployment reference documents the equivalent standalone configuration with STORE_PATH=/app and warns that the value should be absolute. A relative path can resolve against the image’s working directory instead of the mounted volume. Gateway may then appear to work during the first run while writing its configuration outside the persistent volume; after a restart or replacement, saved connections can disappear.
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
Use all three checks below before adding real credentials:
- The Docker volume is mounted at
/app, shown indocker inspect drizzle-gateway. - The container environment contains
STORE_PATH=/app. - You can stop and recreate the container while retaining the same named volume.
To perform a non-destructive persistence test, create a harmless test connection or configuration entry, stop the container, remove only the container, and start a new container with the same volume and environment file. Do not run docker volume rm drizzle-gateway during this test; deleting the volume removes the stored Gateway data.
Named volume versus bind mount
| Storage choice | Example | Advantages | Trade-off |
|---|---|---|---|
| Named Docker volume | -v drizzle-gateway:/app |
Minimal host-path decisions and a clean Docker-managed data store | You use Docker commands or a volume-aware backup process to inspect and copy its contents. |
| Bind mount | -v /srv/drizzle-gateway:/app |
Obvious host location for filesystem backups, monitoring, and disk quotas | You must create the directory, preserve suitable ownership and permissions, and protect it from accidental edits. |
Whichever option you choose, the right-hand side of the mount and STORE_PATH must remain the same absolute path inside the container: /app in these examples. A bind mount does not improve durability by itself; it simply makes the host path explicit.
Back up the Gateway volume
Back up the volume because it contains the Gateway configuration and saved database connections. No mandated schedule or backup vendor applies, so choose a cadence that matches how often your team changes connections and how much configuration loss you can tolerate. At minimum, test that a backup can be read and restored on a separate Docker host.
One common Docker-native pattern is to stream the volume into a compressed archive container. Stop Gateway first if you want a quiescent copy, then adapt the destination to your backup system:
docker stop drizzle-gateway
docker run --rm
-v drizzle-gateway:/data:ro
-v "$PWD":/backup
alpine tar czf /backup/drizzle-gateway-backup.tar.gz -C /data .
docker start drizzle-gatewayThe command illustrates the data flow; protect the resulting archive as sensitive data because saved connection strings can contain database credentials. Restore only into a trusted host and verify the volume contents before starting a production Gateway container.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchRank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
Register databases at first boot or in the UI
Pre-register connections with DATABASE_URL variables
Gateway can create initial connections from environment variables named with the pattern DATABASE_URL_<name>. For example:
MASTERPASS=replace-with-a-long-unique-secret
PORT=4983
STORE_PATH=/app
DATABASE_URL_Production=postgres://user:password@db.example.internal:5432/app
DATABASE_URL_Analytics=postgres://analytics_user:password@analytics.example.internal:5432/warehouseUse names that are clear to your team, such as Production or Analytics. These values contain credentials, so put them in the protected environment file only when first-boot automation is worth the secret-management cost. Do not paste them into shell history, tickets, chat, or public configuration repositories.
Pre-registration is useful for an infrastructure deployment that must be reproducible. It is less convenient when credentials rotate frequently or when each user should enter a connection interactively. Keep in mind that environment variables are supplied when the container starts; changing the file does not automatically rewrite an already-running Gateway configuration. Restart the container using the same persistent volume when a startup-time change is required, and confirm how the current Gateway image handles an existing connection before replacing credentials.
Add a connection through the Gateway interface
- Open the Gateway URL through your private network or HTTPS proxy.
- Sign in with the master password.
- Use the interface’s connection-creation control and enter the database URL or the fields requested by the form.
- Save the connection, then run a harmless read-only check against the intended database.
- Record which network path the VPS uses to reach that database, including any allowlist entry or private DNS requirement.
The UI method keeps database URLs out of the container start command, but the saved connection still resides in the persistent Gateway store. Apply the same backup and access-control rules to connections entered interactively.
Put HTTPS or a private tailnet in front of Gateway
HTTPS reverse-proxy pattern
For a browser-accessible service, terminate TLS at a reverse proxy and keep Gateway bound to localhost or a private interface. Configure the proxy with:
- A DNS record pointing the Gateway hostname to the proxy’s public endpoint.
- A valid certificate for that hostname and automatic renewal appropriate to your proxy.
- HTTP forwarding from the proxy to
127.0.0.1:4983(or the private VPS address you selected). - Rate limiting and access logging at the edge, with sensitive query strings and authorization data excluded from logs.
- A firewall rule that permits public HTTPS only to the proxy, not directly to port 4983.
After DNS and certificates are active, test the complete path in a private browser window: load the HTTPS URL, sign in, create or open a test connection, and confirm that the proxy does not redirect the application to an unreachable HTTP address. Keep the direct local check available for diagnosing whether a failure is in Gateway or in the proxy.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
Private access with Tailscale
Drizzle’s Tailscale tutorial demonstrates a private-domain pattern, optional database forwarding, and removal of the public domain so Gateway is reachable only through the tailnet. The principle is straightforward: install the overlay-network client on the VPS and authorized devices, bind or expose Gateway on the VPS address reachable through that network, and publish a private DNS name instead of a public one.
This model removes public scanning and certificate exposure from the Gateway endpoint, but it does not eliminate authentication. Keep MASTERPASS and per-user passcodes enabled, revoke tailnet access for former users, and ensure that the tailnet route can reach only the databases and services that team members actually need.
Security checklist before inviting users
- Replace the sample master password with a unique long secret.
- Store secrets in a protected environment file or secret manager; do not commit them to a repository.
- Use per-user passcodes rather than sharing one login wherever the Gateway interface supports them.
- Prefer a private tailnet or an HTTPS reverse proxy over direct public port 4983.
- Allow only intended administration and proxy or tailnet ports through the VPS firewall.
- Restrict database firewall rules so only the VPS or its private network can connect.
- Back up the Docker volume and protect backup archives as credential-bearing data.
- Monitor container restarts and proxy access logs for unexpected activity.
- Plan how you will rotate database credentials and update the corresponding Gateway connections.
Do not describe an installation as secure merely because the login screen appears. Authentication, encryption in transit, network reachability, least-privilege database accounts, and recovery procedures address different failure modes.
Updating the image without losing configuration
The quick start uses the latest image tag, which makes pulling updates simple but does not pin a specific release. Before an update, confirm that your volume backup is readable and note the current image identifier:
docker image inspect ghcr.io/drizzle-team/gateway:latest --format '{{.Id}}'
docker pull ghcr.io/drizzle-team/gateway:latestRecreate the container with the same name, environment file, port mapping, image, and volume. The persistent volume is the part that must not change:
docker stop drizzle-gateway
docker rm drizzle-gateway
docker run -d
--name drizzle-gateway
--restart always
--env-file /etc/drizzle-gateway.env
-p 127.0.0.1:4983:4983
-v drizzle-gateway:/app
ghcr.io/drizzle-team/gateway:latestCheck logs and sign in after the replacement. If the new image does not behave as expected, stop it and restore the previous image while keeping the data volume unchanged. Do not delete the volume as a troubleshooting step.
Troubleshooting common deployment failures
| Symptom | Likely cause | What to check |
|---|---|---|
| Container exits immediately | Missing or invalid environment values, an image startup error, or a port conflict | Run docker logs drizzle-gateway; verify MASTERPASS, PORT, and that no other process owns port 4983. |
| Browser cannot connect from the internet | The container is bound to localhost, the firewall blocks the edge, DNS is wrong, or the proxy is not forwarding | Test locally with curl, then test the proxy or tailnet path separately. Confirm that DNS points to the intended endpoint. |
| Connections vanish after a restart | STORE_PATH is relative or does not match the mounted volume |
Inspect the container’s mounts and environment; ensure the volume is mounted at /app and STORE_PATH=/app. |
| Gateway loads but a database test fails | The VPS cannot resolve or reach the database, credentials are wrong, or the database firewall rejects the VPS | Check DNS, routing, database allowlists, TLS requirements, and the URL’s username, password, host, and port from the VPS network. |
| Pre-registered databases do not appear | The variable name is malformed, the URL was added after first start, or the environment file was not loaded | Verify the exact DATABASE_URL_<name> pattern, inspect the container environment without exposing secrets, and recreate or restart with the intended file and persistent volume. |
| HTTPS login loops or assets fail | The proxy is forwarding to the wrong address or mishandling the application’s HTTP requests | Compare a direct local request with the proxied request, inspect proxy error logs, and verify that the public hostname and TLS termination are consistent. |
Docker VPS, managed deployment, or a standalone binary?
| Deployment | Control | Persistence responsibility | Best fit |
|---|---|---|---|
| Manual Docker on a VPS | Full control over networking, firewall, upgrades, and storage | You manage the Docker volume, backups, secrets, and host maintenance | Teams that need a private network path or predictable infrastructure. |
| Managed Railway deployment | Less host administration and a platform-managed runtime | You still need to configure an absolute STORE_PATH, persistent storage, secrets, and recovery |
Teams that prefer a managed application platform over server maintenance. |
| Standalone Linux binary | No Docker daemon or container lifecycle | You choose the service account, filesystem path, process supervisor, and backup method | Hosts where Docker is unavailable or a native process is preferred. |
These approaches run the same Gateway concept but shift operational responsibility. A VPS container is not automatically cheaper, safer, or more available than a managed platform; its advantage is direct control over the network path and persistent storage.
Recommended first-day runbook
- Install Docker and verify that the daemon can run containers.
- Choose private tailnet access or an HTTPS proxy; do not expose port 4983 casually.
- Create the named volume and a mode-600 environment file containing
MASTERPASS,PORT=4983, andSTORE_PATH=/app. - Pull
ghcr.io/drizzle-team/gateway:latestand start the container with the volume mounted at/app. - Confirm container logs, a local HTTP response, and a browser login.
- Add one read-only test connection, verify network access from the VPS, and then add production connections.
- Create and test a volume backup before inviting additional users.
- Document the hostname, access path, secret owner, database allowlists, and the exact recreation command.
Following this sequence separates application problems from DNS, firewall, proxy, and database-network problems. It also gives you a known-good recovery path before the Gateway store contains a large set of team connections.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →
