# Forcing TLS with Postgres and pg\_tls handler

**URL:** <https://community.fly.io/t/forcing-tls-with-postgres-and-pg-tls-handler/18463>\
**Category:** Questions / Help\
**Tags:** wishlist, postgres, login-only\
**Created:** [February 28, 2024, 9:47pm UTC](https://community.fly.io/t/forcing-tls-with-postgres-and-pg-tls-handler/18463 "2024-02-28T21:47:06Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![mattheworiordan](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/mattheworiordan/32/18344_2.png) [@mattheworiordan](https://community.fly.io/u/mattheworiordan)\
**Post date:** [February 28, 2024, 9:47pm UTC](https://community.fly.io/t/forcing-tls-with-postgres-and-pg-tls-handler/18463/1 "2024-02-28T21:47:06Z")

</div>

I have a Postgres cluster running, but would like to allow access from a Metabase server we run with a separate cloud service. I’ve gone ahead and opened up the Postgres DB using the [new proxy handler: pg\_tls](https://community.fly.io/t/new-proxy-handler-pg-tls-postgresql-sslmode/8788), however I now see that the `pg_tls` does not enforce TLS. I think it’s pretty insane to have a Postgres server open to the Internet which allows plain text connections, so want to force all connections to be TLS. This does not appear to be possible. Whilst the fly.toml file has support for `force_https`, there appears to be no equivalent for `pg_tls`.

Can you advise:

- What was the thinking behind allowing plain text connections by default with a `pg_tls` handler which is clearly for TLS connections?
- How can I override this and force TLS connections only?
- Is there anything more sophisticated (from a security perspective) you’re considering for Postgres connections such as certificate auth, or restrictions by host/IP etc?

---

<div class="post-metadata">

**Author:** ![mayailurus](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/mayailurus/32/17593_2.png) [@mayailurus](https://community.fly.io/u/mayailurus)\
**Post date:** [March 1, 2024, 4:55pm UTC](https://community.fly.io/t/forcing-tls-with-postgres-and-pg-tls-handler/18463/2 "2024-03-01T16:55:59Z")

</div>

Tags updated on March 1, 2024, 4:55pm UTC

Added #wishlist

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/fly1/original/3X/6/e/6e8955d00cb218e186ebbe3a6ab06fefdce15290.svg) [@system](https://community.fly.io/u/system)\
**Post date:** [March 8, 2024, 4:56pm UTC](https://community.fly.io/t/forcing-tls-with-postgres-and-pg-tls-handler/18463/3 "2024-03-08T16:56:21Z")

</div>

Closed on March 8, 2024, 4:56pm UTC

This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.