# Error connecting from pgadmin to postgres behind traefik

**URL:** <https://community.traefik.io/t/error-connecting-from-pgadmin-to-postgres-behind-traefik/26025>\
**Category:** Traefik v2\
**Tags:** tcp, kubernetes-ingress\
**Created:** [January 14, 2025, 12:40pm UTC](https://community.traefik.io/t/error-connecting-from-pgadmin-to-postgres-behind-traefik/26025 "2025-01-14T12:40:30Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![TrueDru](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/truedru/32/9834_2.png) [@TrueDru](https://community.traefik.io/u/TrueDru)\
**Post date:** [January 14, 2025, 12:40pm UTC](https://community.traefik.io/t/error-connecting-from-pgadmin-to-postgres-behind-traefik/26025/1 "2025-01-14T12:40:30Z")

</div>

Hello!  
This is my configuration (values for traefik helm chart):

```auto
logs:
  general:
    level: INFO
  access:
    enabled: true
    format: json

entryPoints:
  postgres5432:
    address: ":5432"

ports:
  postgres5432:
    port: 5432
    expose:
      default: true
    exposedPort: 5432
    protocol: TCP
    tls:
      enabled: false

```

This is my ingressroutetcp:

```auto
apiVersion: traefik.io/v1alpha1
kind: IngressRouteTCP
metadata:
  name: postgres-ingressroute
  namespace: test
spec:
  entryPoints:
    - postgres5432
  routes:
    - match: HostSNI(`mydomain.com`)
      services:
        - name: database
          port: 5432
  tls:
    secretName: main-domain-cert

```

It works fine with dbeaver without any issues, i don't enable ssl in connection, just url and credentials.

**PROBLEM:**  
When i try to connect to this instance with PGadmin i get errors:  
Traefik log:

```auto
ERR Error while handling TCP connection error="readfrom tcp 10.233.113.222:36488->10.233.89.116:5432: tls: client requested unsupported application protocols ([postgresql])"
ERR Error while handling TCP connection error="readfrom tcp 10.233.113.222:60892->10.233.112.195:5432: remote error: tls: user canceled"

```

And pgadmin says about timeout

I tried this:

```auto
apiVersion: traefik.io/v1alpha1
kind: TLSOption
metadata:
  name: postgresql
  namespace: traefik
spec:
  alpnProtocols:
    - postgresql

```

with this IngressRouteTCP:

```auto
apiVersion: traefik.io/v1alpha1
kind: IngressRouteTCP
metadata:
  name: postgres-ingressroute
  namespace: test
spec:
  entryPoints:
    - postgres5432
  routes:
    - match: HostSNI(`mydomain.com`)
      services:
        - name: database
          port: 5432
  tls:
    secretName: main-domain-cert
    options:
      name: postgresql

```

it breaks dbeaver connection with error _Connection peer shutdown incorrectly_ even if i use **ssl\_mode=require** in dbeaver settings and in connection string  
pgadmin still doesn't work.

My task is to provide access for developers to PostgreSQL within the Kubernetes cluster

---

<div class="post-metadata">

**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\
**Post date:** [January 14, 2025, 12:43pm UTC](https://community.traefik.io/t/error-connecting-from-pgadmin-to-postgres-behind-traefik/26025/2 "2025-01-14T12:43:32Z")

</div>

It seems your client is not using TLS.

You can try to change `HostSNI(`mydomain.com`)` to `HostSNI(`*`)`, then Traefik will not enable TLS and just pass the TCP connection through to the target service. But then you can only have a single service on the port.

Or you need to figure out how to force the client to use regular TLS with HostSNI.

---

<div class="post-metadata">

**Author:** ![TrueDru](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/truedru/32/9834_2.png) [@TrueDru](https://community.traefik.io/u/TrueDru)\
**Post date:** [January 14, 2025, 12:55pm UTC](https://community.traefik.io/t/error-connecting-from-pgadmin-to-postgres-behind-traefik/26025/3 "2025-01-14T12:55:20Z")

</div>

With \* in HostSNI it works with dbeaver and pgadmin, but it's not my case. I have 2 environments separated by domain names and 2 databases

---

<div class="post-metadata">

**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\
**Post date:** [January 14, 2025, 2:55pm UTC](https://community.traefik.io/t/error-connecting-from-pgadmin-to-postgres-behind-traefik/26025/4 "2025-01-14T14:55:06Z")

</div>

Use a different port for each DB or make your clients use real TLS with HostSNI.

---

<div class="post-metadata">

**Author:** ![chakraborty29](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/chakraborty29/32/10247_2.png) [@chakraborty29](https://community.traefik.io/u/chakraborty29)\
**Post date:** [April 8, 2025, 3:22am UTC](https://community.traefik.io/t/error-connecting-from-pgadmin-to-postgres-behind-traefik/26025/5 "2025-04-08T03:22:13Z")

</div>

This is what worked for me: [Expose Postgres using Traefik V3 - #4 by chakraborty29](https://community.traefik.io/t/expose-postgres-using-traefik-v3/20486/4)