> ## Documentation Index
> Fetch the complete documentation index at: https://www.towbar.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Resources

> Run managed databases and image-based services with persistent storage and recovery.

Resources run from an existing container image. Use them for databases, caches, and supporting services that do not need a repository build.

## Supported types

| Type                           | Use it for                   | Towbar behavior                                                                             |
| ------------------------------ | ---------------------------- | ------------------------------------------------------------------------------------------- |
| `postgres`, `mysql`, `mariadb` | Relational databases         | Authenticated health checks, persistent data volume, native backup and fresh-target restore |
| `mongodb`                      | Document databases           | Authenticated health checks, persistent data volume, native backup and fresh-target restore |
| `redis`, `dragonfly`, `keydb`  | Redis-compatible data        | Password protection, persistent snapshot, backup and fresh-target restore                   |
| `clickhouse`                   | Analytical databases         | Authenticated checks, persistent data, native backup and restore                            |
| `image`                        | Other containerized services | Your image and optional command, declared ports, volumes, and health checks                 |

Images must have an explicit non-`latest` tag or a digest. Managed engines have reviewed digest-pinned defaults. Custom managed images must use a digest and the supported major version. See [Managed databases](/docs/managed-databases) for versions, architectures, secrets, and restore boundaries.

<div className="towbar-doc-screenshot">
  <div className="towbar-product-light">
    <img src="https://mintcdn.com/avgeek/7IKQY5hBmeQaVMw0/assets/release-v2/resource-overview-light.jpg?fit=max&auto=format&n=7IKQY5hBmeQaVMw0&q=85&s=4a1e0eaae927e5cf9e1fc9a348191cc3" alt="Resource state and the latest deployment attempt are shown separately." width="1280" height="720" loading="lazy" data-path="assets/release-v2/resource-overview-light.jpg" />
  </div>

  <div className="towbar-product-dark">
    <img src="https://mintcdn.com/avgeek/7IKQY5hBmeQaVMw0/assets/release-v2/resource-overview-dark.jpg?fit=max&auto=format&n=7IKQY5hBmeQaVMw0&q=85&s=533de8334caabd5b21fd78db92c982b0" alt="Resource state and the latest deployment attempt are shown separately." width="1280" height="720" loading="lazy" data-path="assets/release-v2/resource-overview-dark.jpg" />
  </div>

  <p>Resource state and the latest deployment attempt are shown separately.</p>
</div>

## Resource logos

Towbar recognizes products such as Temporal, Mailpit, Grafana, RabbitMQ, Keycloak,
MinIO, and common databases from their configured container image.
Recognized image resources show the product logo and name in resource lists.

Tags and digests do not change the logo. Docker Hub shorthand and fully qualified
names are recognized, while other registries require an explicit supported alias.
Unknown images and private mirrors keep the Docker logo. Logos are bundled with
Towbar and do not require an external lookup. This is a visual identifier, not a
verification of image provenance or security.

## Add a database

```yaml title="towbar.yml" theme={"system"}
version: 2
environments:
  production:
    previews:
      enabled: true
```

```yaml title=".towbar/resources/database.resource.yml" theme={"system"}
id: database
name: Primary database
type: postgres
server: 192.0.2.10
container:
  network: app-network
  resources:
    cpus: 1
    memory: 1g
access:
  sshTunnel:
    hostPort: 15432
environments:
  production: {}
```

Register the server, then save `POSTGRES_PASSWORD` under **Resource → Settings → Secrets**. Redis resources use `REDIS_PASSWORD`. These values are runtime secrets for the selected environment and never belong in YAML.

Deploy the resource, wait for its health check to pass, and verify connectivity from the intended client.

## Connect privately

Apps and resources on the same host can share a named `container.network`. Towbar reuses the network when it exists and creates a bridge network when it is missing. A resource's `networkAlias` defaults to its ID, so the example database is reachable as `database` from containers on `app-network`.

`access.sshTunnel.hostPort` binds only to the server's `127.0.0.1`. Forward that port over SSH for a local database client. It does not create a public Caddy route or Cloudflare record.

## Persist data

Every managed engine receives a managed data volume. Generic image resources can declare named volumes and mount paths. Deployment and image rollback are not database migration tools: plan engine upgrades and schema compatibility separately.

Changing `POSTGRES_PASSWORD` in Towbar does not rotate the password already stored inside an existing database. Coordinate that change with the database before replacing the running resource.

## Back up and restore

All eight managed engine presets support Towbar-managed backup and restore. Enable one S3, Cloudflare R2, Google Cloud Storage, or Azure Blob runtime integration, reference its provider in the [backup policy](/docs/backups), and verify a fresh-target restore before relying on it. Read the [restore procedure](/docs/restores) before production recovery.