Evaluate
Compatibility and security
Validate CacheDB database paths, driver responsibilities, trusted-network boundaries, and offline operational controls.
CacheDB compatibility depends on the complete path between the application and database: client protocol, SQL dialect, prepared statements, database driver, network topology, and operational controls. Validate the path you intend to operate, rather than treating database support as a single interchangeable feature.
Supported paths
| Database | Client protocol | CacheDB path | Evaluation note |
|---|---|---|---|
| PostgreSQL | PostgreSQL | Native transparent relay | Recommended PostgreSQL path; authentication is relayed. |
| MySQL | MySQL | Native packet relay | Keeps native client protocol; proxy is not a TLS or compression endpoint. |
| PostgreSQL | PostgreSQL | Backend-connection path | Alternative path with its own application compatibility checks. |
| Oracle | PostgreSQL | Translation | Validate SQL/type behavior; operator supplies the licensed driver. |
| SQL Server | PostgreSQL | Translation | Validate SQL/type behavior and the documented TLS certificate boundary. |
| IBM DB2 | PostgreSQL | Translation | Operator supplies the licensed driver. |
Translation is not a universal SQL compatibility promise. Exercise the actual driver, prepared statements, transaction patterns, multi-statement behavior, data types, and error handling in a representative evaluation.
Security is a deployment boundary
CacheDB 1.9 explicitly documents the following limits:
- Native PostgreSQL and MySQL proxy connections are plaintext on the client and backend legs.
- PostgreSQL, Oracle, and DB2 translation backends do not negotiate TLS.
- SQL Server backend TLS currently accepts any certificate rather than enforcing certificate validation.
- Redis cache, metrics, and Sentinel connections do not support TLS.
- The console does not terminate TLS or implement login rate limiting.
Deploy proxy, database, and Redis on a trusted private network segment. When encryption in transit is required, provide it through a service mesh, TLS-terminating sidecar, or network overlay. Put console access behind a trusted reverse proxy or WAF when it is reachable beyond loopback.
Preserve identity and operational control
Do not share a cache namespace between database service identities with different data permissions. Keep configuration files protected by the service account, and treat database, Redis, OIDC, and licence material as operational secrets.
CacheDB licensing is verified locally and supports isolated deployments; the console does not need to contact a vendor service. Without an active licence, the proxy can remain available in transparent mode rather than performing real caching.
For cache-policy execution, Rhai disables dynamic evaluation and imports, applies resource limits, and exposes no filesystem, process, or network primitives. Policy review remains necessary because a valid policy can still affect result reuse and invalidation.
Request a compatibility and security review with the database, protocol, and deployment constraints you need to validate.