Postgres unencrypted

[danverbs]

I've set up a postgres instance in one of my projects and set up for external access but when I connect to it using Postico, it says the connection is unencrypted? How do I ensure this is encrypted?

If I set my cloudflare DNS to 'DNS Only' I get this message but can connect, if I set it to 'Proxied' I can't connect at all - the SSL connection is set to 'Full'

[Siumauricio]

I will need to test this, because I've used pgadmin and dbeaber and 0 issues, probably it may need to adjust the database connection because it depends on the driver the tool are using

[Siumauricio]

@danverbs I test and it was working looks like using the domain as hostname is not working only with the ip of the vps

[danverbs]

Ok so don't use the url provided in Dokploy settings? Just the ip of the vps?

[Siumauricio]

Correct @danverbs, for now just use the IP when I have more time I will investigate about this, but for now is functional

[danverbs]

I will try this and let you know. Thanks 👍🏻

[danverbs]

I tried with just the IP and it still says 'The server doesn't support TLS' and is unencrypted. Could you share the steps you took to set this up?

[Siumauricio]

Hey @danverbs , I tested and it was working I share the configuration

1. Create a postgres database (In my case only set the database name)
2. Expose port, type 5432 and then save.
3. copy the postgresql connection.

4. go to Postico
   
5. type the postgresql connection but remember to remove the domain and set the ip of your vps
   
6. Click add server
7. Select the database, click on test button it will appear some alert about TLS just accept it
   
8. Then click on test to check the connection is working
   

[danverbs]

Thanks - I can connect as shown in your steps but Postico still says the connection is unencrypted? Surely we want it to be encrypted?

[Siumauricio]

The question is that it marks you that it is not a secure connection because we do not implement any configuration for the domain with that port, but making adjustments with some traefik configuration would be enough to achieve that result.

What I recommend in case you are afraid or something like that that the probability that it will happen is really low, is simply when you finish doing your tasks in the database remove the exposed port that way no one will be able to access the database from outside.