# Connecting to a postgres DB externally securely **URL:** \ **Category:** Questions / Help\ **Tags:** postgres\ **Created:** [October 13, 2021, 5:54pm UTC](https://community.fly.io/t/connecting-to-a-postgres-db-externally-securely/2828 "2021-10-13T17:54:09Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![harg](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/harg/32/17685_2.png) [@harg](https://community.fly.io/u/harg)\ **Post date:** [October 13, 2021, 5:54pm UTC](https://community.fly.io/t/connecting-to-a-postgres-db-externally-securely/2828/1 "2021-10-13T17:54:09Z")
Sorry lots of questions from me today, only got going with Fly yesterday! So I have a postgres cluster and need to connect to from outside the internal network (for reporting etc). I’m not using wireguard; instead I followed the [guide for external port configuration](https://fly.io/docs/getting-started/multi-region-databases/#external-port-configuration). This works OK to the extent that I’m able to connect to my db via an “insecure connection”. I.e. `.fly.dev:10000` (as is the port in the guide’s example). In the guide there is another `[[services.ports]]` block for a “secure connection” using port 443. I can’t seem to connect via this port. Is there something else I need to do, like specify a certificate? ---
**Author:** ![kurt](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/kurt/32/43757_2.png) [@kurt](https://community.fly.io/u/kurt)\ **Post date:** [October 14, 2021, 5:12pm UTC](https://community.fly.io/t/connecting-to-a-postgres-db-externally-securely/2828/2 "2021-10-14T17:12:20Z")
Ok it turns out, our docs are wrong. We _can’t_ do TLS for postgres through our proxy. Postgres expects to do its own protocol negotiation when people connect (and use the same port for non-TLS and TLS connections). We don’t have a built-in way to expose Postgres to the public internet and connect to it over TLS. The best way to do this might be with pgbouncer. You could create a separate pgbouncer application on Fly, configure it to support TLS with an embedded certificate, and point it at your postgres cluster over the private network. In general, building little gateway apps might be better than touching your postgres directly. ---
**Author:** ![harg](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/harg/32/17685_2.png) [@harg](https://community.fly.io/u/harg)\ **Post date:** [October 15, 2021, 10:11am UTC](https://community.fly.io/t/connecting-to-a-postgres-db-externally-securely/2828/3 "2021-10-15T10:11:16Z")
Hmmm, this is a bit of an issue. Basically I’m trying to connect my mode analytics account to my DB and Mode only allows directly connecting using an encrypted connection. Do you know of any resources that could help with configuring pgbouncer on Fly? It’s not something I’ve ever used before. Alternatively, do you know if Fly intends to support encrypted external connections to postgres dbs anytime soon? ---
**Author:** ![kurt](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/kurt/32/43757_2.png) [@kurt](https://community.fly.io/u/kurt)\ **Post date:** [October 15, 2021, 1:15pm UTC](https://community.fly.io/t/connecting-to-a-postgres-db-externally-securely/2828/4 "2021-10-15T13:15:02Z")
Oh you might be in luck. Try installing this and pointing it at your database over the private network: [https://mode.com/help/articles/connecting-mode-to-your-database/#run-bridge-in-a-docker-container](https://mode.com/help/articles/connecting-mode-to-your-database/#run-bridge-in-a-docker-container) Most BI/analytics tools have a way to do this without opening a DB up to the internet. ---
**Author:** ![harg](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/harg/32/17685_2.png) [@harg](https://community.fly.io/u/harg)\ **Post date:** [October 15, 2021, 2:37pm UTC](https://community.fly.io/t/connecting-to-a-postgres-db-externally-securely/2828/5 "2021-10-15T14:37:51Z")
Nice, yeah the bridge did the trick. Thanks for your help ---
**Author:** ![kurt](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/kurt/32/43757_2.png) [@kurt](https://community.fly.io/u/kurt)\ **Post date:** [October 15, 2021, 10:53pm UTC](https://community.fly.io/t/connecting-to-a-postgres-db-externally-securely/2828/6 "2021-10-15T22:53:03Z")
Oh amazing, I’m glad that worked! ---
**Author:** ![cjl](https://avatars.discourse-cdn.com/v4/letter/c/b487fb/32.png) [@cjl](https://community.fly.io/u/cjl)\ **Post date:** [December 20, 2021, 7:47pm UTC](https://community.fly.io/t/connecting-to-a-postgres-db-externally-securely/2828/7 "2021-12-20T19:47:55Z")
@kurt @harg hey guys I hope you had a great weekend! If I had cloned [GitHub - fly-apps/postgres-ha: Postgres + Stolon for HA clusters as Fly apps.](https://github.com/fly-apps/postgres-ha) what would I have to add from [https://mode.com/help/articles/connecting-mode-to-your-database/#run-bridge-in-a-docker-container](https://mode.com/help/articles/connecting-mode-to-your-database/#run-bridge-in-a-docker-container) to allow a public connection? ---
**Author:** ![cjl](https://avatars.discourse-cdn.com/v4/letter/c/b487fb/32.png) [@cjl](https://community.fly.io/u/cjl)\ **Post date:** [December 20, 2021, 8:01pm UTC](https://community.fly.io/t/connecting-to-a-postgres-db-externally-securely/2828/8 "2021-12-20T20:01:10Z")
I am trying to make my db publicly available so [Instant GraphQL APIs on your data | Built-in Authz & Caching (hasura.io)](https://hasura.io/) can connect to it. ---
**Author:** ![kurt](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/kurt/32/43757_2.png) [@kurt](https://community.fly.io/u/kurt)\ **Post date:** [December 20, 2021, 8:10pm UTC](https://community.fly.io/t/connecting-to-a-postgres-db-externally-securely/2828/9 "2021-12-20T20:10:02Z")
@cjl does Hasura’s setup work with other hosting? You can run Hasura on [Fly.io](http://Fly.io) just fine! If you really need to open Postgres up to the world, we have instructions. It’s just not ideal and something you should avoid if you can: [Postgres on Fly](https://fly.io/docs/reference/postgres/#connecting-to-postgres-from-outside-fly) ---
**Author:** ![cjl](https://avatars.discourse-cdn.com/v4/letter/c/b487fb/32.png) [@cjl](https://community.fly.io/u/cjl)\ **Post date:** [December 20, 2021, 8:14pm UTC](https://community.fly.io/t/connecting-to-a-postgres-db-externally-securely/2828/10 "2021-12-20T20:14:37Z")
@kurt we have an enterprise plan with them, I am seeing if they can setup Wireguard. In the meantime we need to test the staging application and connect directly to it. Is it not possible to expose the port like [myflyapp.fly.dev:5432](http://myflyapp.fly.dev:5432) (I would do a random port instead of 5432)? ---
**Author:** ![cjl](https://avatars.discourse-cdn.com/v4/letter/c/b487fb/32.png) [@cjl](https://community.fly.io/u/cjl)\ **Post date:** [December 20, 2021, 8:21pm UTC](https://community.fly.io/t/connecting-to-a-postgres-db-externally-securely/2828/11 "2021-12-20T20:21:00Z")
Looks like this works: ```auto [[services]] internal_port = 5432 # Postgres instance protocol = "tcp" [[services.ports]] handlers = [] port = 10000 ``` Is there a more secure way? 443 did not work. ---
**Author:** ![kurt](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/kurt/32/43757_2.png) [@kurt](https://community.fly.io/u/kurt)\ **Post date:** [December 20, 2021, 10:44pm UTC](https://community.fly.io/t/connecting-to-a-postgres-db-externally-securely/2828/12 "2021-12-20T22:44:40Z")
I think you’re asking if you can do Postgres + TLS. The answer is not really. Postgres TLS is a weird protocol that our edge proxies don’t support. Doing Postgres TLS on Fly would mean generating your own certificates, then installing something like [pgbouncer](https://community.fly.io/t/how-to-setup-and-use-pgbouncer-with-fly-postgres/3035/2) (or possibly haproxy) as a Fly app to manage those connections. It’s probably doable, but a little complex. ---
**Author:** ![pier](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/pier/32/74_2.png) [@pier](https://community.fly.io/u/pier)\ **Post date:** [February 11, 2022, 9:36pm UTC](https://community.fly.io/t/connecting-to-a-postgres-db-externally-securely/2828/13 "2022-02-11T21:36:09Z")
I imagine another solution to connect to PG securely from outside Fly would be using Wireguard. It was quite easy to set up that locally on macOS, but now I need to connect to PG from Google Cloud Run. I think it should be easy to install wireguard on Docker and then add the conf from a secret mounted to a path on the file system. I will try that and report back! Edit: I failed miserably lol I’ve never used Wireguard before and just now realized maybe the conf provided by the Fly CLI is probably specific to my dev machine. Even if that wasn’t the case, I can’t seem to start `wg-quick` on the Docker instance. After a number of tries and errors I got stuck at: ```auto [#] ip link add basic type wireguard RTNETLINK answers: Operation not permitted Unable to access interface: Operation not permitted ``` From what I’ve seen online seems to be some Linux kernel headers shenanigans way above my Docker/Linux skill. Unfortunately, this means I won’t be able to use PG on Fly since it’s not possible to use TLS either (from @kurt comments above). Edit: On second thought… I think I will just create an API so that Google Cloud Run never touches PG. It’s a bit of a nuisance but seems like a better choice than using a different PG provider if the main app is running on Fly.