# New proxy handler: pg\_tls (PostgreSQL sslmode)

**URL:** <https://community.fly.io/t/new-proxy-handler-pg-tls-postgresql-sslmode/8788>\
**Category:** General\
**Tags:** announcement, postgres\
**Created:** [November 18, 2022, 7:17pm UTC](https://community.fly.io/t/new-proxy-handler-pg-tls-postgresql-sslmode/8788 "2022-11-18T19:17:18Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![jerome](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/jerome/32/17_2.png) [@jerome](https://community.fly.io/u/jerome)\
**Post date:** [November 18, 2022, 7:17pm UTC](https://community.fly.io/t/new-proxy-handler-pg-tls-postgresql-sslmode/8788/1 "2022-11-18T19:17:18Z")

</div>

There’s a new handler available for exposing your PostgreSQL instance over the proxy in a secure manner: `pg_tls`.

**How to use?**

First, get your current config if you don’t already have it

```auto
fly config save -a <your-pg-fly-app-name>

```

Then, modify your `fly.toml`, adding this service:

```nohighlight
[[services]]
internal_port = 5432
protocol = "tcp"

[[services.ports]]
handlers = ["pg_tls"]
port = 5432

```

Figure out which image and tag (postgres version) you’re on:

```bash
$ fly image show -a <your-pg-fly-app-name>
Image Details
  Registry = registry-1.docker.io
  Repository = flyio/postgres
  Tag = 13.6
  Version = v0.0.32

```

Finally, deploy your cluster (using `--image` with the `image:tag` found in the previous step):

```auto
fly deploy --image flyio/postgres:13.6

```

You should then be able to access your PG cluster via `psql` like:

```bash
$ psql "sslmode=require host=<your-pg-fly-app-name>.fly.dev dbname=<db name> user=<username>"
Password for user <username>:
psql (14.5 (Homebrew), server 13.6 (Debian 13.6-1.pgdg110+1))
SSL connection (protocol: TLSv1.3, cipher: TLS_AES_256_GCM_SHA384, bits: 256, compression: off)
Type "help" for help.

<db name>=#

```

~~Note: this only works for `sslmode=require` or `sslmode=prefer`, any other options will close the connection.~~

Edit: `sslmode=disable` is now supported. A setting could be provided to only allow SSL I imagine. If anybody has that need, let us know.

---

<div class="post-metadata">

**Author:** ![jerome](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/jerome/32/17_2.png) [@jerome](https://community.fly.io/u/jerome)\
**Post date:** [November 23, 2022, 4:03pm UTC](https://community.fly.io/t/new-proxy-handler-pg-tls-postgresql-sslmode/8788/2 "2022-11-23T16:03:10Z")

</div>

Split this topic on November 23, 2022, 4:03pm UTC

37 posts were split to a new topic: [Preset.io and the pg\_tls handler](https://community.fly.io/t/preset-io-and-the-pg-tls-handler/8923)

---

<div class="post-metadata">

**Author:** ![sepbox](https://avatars.discourse-cdn.com/v4/letter/s/f475e1/32.png) [@sepbox](https://community.fly.io/u/sepbox)\
**Post date:** [April 28, 2023, 7:55am UTC](https://community.fly.io/t/new-proxy-handler-pg-tls-postgresql-sslmode/8788/25 "2023-04-28T07:55:45Z")

</div>

this is amazing. i was able to use `handlers = ["pg_tls", "proxy_proto"]` which feeds into `haproxy` with `bind *:5432 accept-proxy` and have ip based filtering for incoming connection.