Follow https://www.digitalocean.com/community/articles/how-to-secure-mysql-and-mariadb-databases-in-a-linux-vps on a new droplet and then secure it by configuring mysql to listen on the private network interface by editing /etc/mysql/my.cnf and setting bind-address to your private IP address. Finally, install a firewall on your droplet so that only your app server can connect to your MySQL server: https://www.digitalocean.com/community/articles/how-to-setup-a-firewall-with-ufw-on-an-ubuntu-and-debian-cloud-server.

I did this using CentOS. Basic workflow:

1) Create droplet, preferably in the same private network as your web server
2) Configure firewall (on db server) to close ALL ports, then open port 3306 to allow database traffic ONLY from your web server's private IP address. You will also need to open port 22 so you can SSH in. Can also restrict which IP you can SSH in from, essentially creating a tunnel to your db server via your web server (or whatever other IP you want to use).
3) Install MySQL and set up users

Here's what I did:
http://jessesnet.com/development-notes/2014/centos-mysql-vps-setup/

http://www.jessesnet.com/development-notes/2014/centos-mysql-vps-setup/

404 not found :D

@kurniawanmagelang it's http://jessesnet.com/development-notes/2014/centos-mysql-vps-setup/ without www