Dev tools · September 26, 2024
PGT-Proxy – A PostgreSQL Proxy in 277 Lines of Rust
It's time we talked about something many developers, data analysts, and even web application servers are guilty of: downgrading PostgreSQL connection security. Too often, we see connections dropped from full TLS verification to "any TLS" (i.e., sslmode=require) or, even worse, plain text connections. Why? Because most cloud providers, like AWS or Google Cloud SQL, use non-public Certificate Authorities for PostgreSQL. The result? Unverified TLS connections because no one has time to set up all devices across an organization to trust custom certificate authorities. And here's the most…
In plain words
PGT-Proxy is a PostgreSQL proxy written in Rust that enables secure database connections without compromising on TLS verification. It acts as an intermediary server, allowing developers and applications to connect to PostgreSQL instances using full certificate verification even when cloud providers use non-public Certificate Authorities. The tool addresses the common practice of downgrading security by accepting unverified TLS or plain text connections, making it useful for developers, data analysts, and web application servers that need secure database access across organizations without complex certificate setup.
written from the facts on this page · September 2026
From the sources
In the maker’s words, at launch
It's time we talked about something many developers, data analysts, and even web application servers are guilty of: downgrading PostgreSQL connection security. Too often, we see connections dropped from full TLS verification to "any TLS" (i.e., sslmode=require) or, even worse, plain text connections. Why? Because most cloud providers, like AWS or Google Cloud SQL, use non-public Certificate Authorities for PostgreSQL. The result? Unverified TLS connections because no one has time to set up all devices across an organization to trust custom certificate authorities. And here's the most egregious part: some vendors that need to connect to your database outright recommend downgrading TLS, disabling TLS, or placing private databases in public subnets. I was so fed up of seeing this. So I wrote and open sourced PGT-Proxy! == What is PGT-Proxy? == PGT-Proxy is an intermediary server that securely bridges TLS-enabled PostgreSQL clients and servers. It acts as a reverse proxy with support for PostgreSQL's unique TLS protocol, which requires bidirectional transmission of special bytes before initiating the TLS handshake. The protocol is why you can't just stick a load balancer in front of a PostgreSQL database and expect it to work. == Key Features == TLS Termination and Initiation: PGT-Proxy handles TLS connections on both the client and server sides, ensuring end-to-end encryption. Certificate Management: Supports custom certificate authorities, enabling full TLS verification even with non-public CAs. Binary or Dockerized Deployment: Deploy with a binary or available as a Docker image on Docker Hub, making it easy to integrate into your existing infrastructure. Small Footprint: PGT-Proxy is built on Rust, with a very lightweight Docker image that is limited to a trimmed OS and a binary file for PGT-Proxy. == Why I Built PGT-Proxy == Our customers needed secure connections from our network to their private PostgreSQL databases, without the hassle of managing custom CAs or setting up complex network configurations. We realized that the lack of straightforward tools enforcing proper TLS connections led many to adopt insecure practices. By creating PGT-Proxy, I aim to make secure, fully verified TLS connections simple and accessible. == Try It == You can see the source code on GitHub, use the public docker image, and let me know what you think. I'm around to answer questions, take feedback, or even show you how to use it (the docs are pretty good, but my email is on my profile if you need me). https://github.com/ambarltd/pgt-proxy https://hub.docker.com/r/ambarltd/pgt-proxy
More dev tools this month
the category →
Open-source GTM skills for technical founders
Dev tools · 29d ago · gtmcofounder.com
OpenTrailPaper is open-source bike computer firmware for the LilyGO T5S3 4.7" E-Paper PRO. It supports offline maps, GPX routes, FIT recording and Bluetooth sensors.
Dev tools · 1d ago · opentrailpaper.com
Launched alongside, September 2024
the whole month →
BeforeSunset AI 2.0▲1,267Personalized AI daily planning that suits your life
AI · 2024 · beforesunset.ai
