# Forward http(s) to postgresql container in docker swarm/compose possible?

**URL:** <https://community.traefik.io/t/forward-http-s-to-postgresql-container-in-docker-swarm-compose-possible/18938>\
**Category:** Traefik v2\
**Tags:** docker\
**Created:** [June 12, 2023, 1:28pm UTC](https://community.traefik.io/t/forward-http-s-to-postgresql-container-in-docker-swarm-compose-possible/18938 "2023-06-12T13:28:45Z")\
**Posts on this page:** 12\
**Page:** 1

<div class="post-metadata">

**Author:** ![gerrga](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/gerrga/32/4163_2.png) [@gerrga](https://community.traefik.io/u/gerrga)\
**Post date:** [June 12, 2023, 1:28pm UTC](https://community.traefik.io/t/forward-http-s-to-postgresql-container-in-docker-swarm-compose-possible/18938/1 "2023-06-12T13:28:45Z")

</div>

Hi,  
Im woring in a strict environment and I have access to the postgresql machine only via http/https.  
On this postgresql machine I would run 2 parallel environments with docker compose.  
Is there a possibility to forward the http/https to the postgres container on 5432?  
The other problem is , the postgres is in the non-external network. So is my scenario possible?

Here is my try

Traefik config

```auto
EntryPoints:
  web:
    address: :80
    # (Optional) Redirect to HTTPS
    # ---
    http:
      redirections:
        entryPoint:
          to: websecure
          scheme: https
  websecure:
    address: :443

```

And the compose config for traefik

```auto
version: '3.7'
services:

  reverse-proxy:
    container_name: traefik

    # The official v2 Traefik docker image
    image: traefik:v2.8
    ports:
      # The HTTP port
      - "80:80"
      - "443:443"
    volumes:
      # So that Traefik can listen to the Docker events
      - /var/run/docker.sock:/var/run/docker.sock
      - /docker/traefik/config:/etc/traefik
      - /docker/traefik/certs/:/etc/traefik/certs
      - /docker/traefik/log/:/var/log/traefik

    networks:
      - proxy

    restart: always

networks:
  proxy:
    name: proxy

```

Compose for Postgres

```auto
version: "3.7"
services: 
  db:
    image: postgres:14

    environment:
      - POSTGRES_DB=mydb
      - POSTGRES_USER=postgres
      - POSTGRES_PASSWORD=postgres
    networks:
      - private-network
    labels:      
      traefik.enable: 'true'      
      traefik.http.routers.dev-db.rule: Host(`myhost-name`)      
      traefik.http.routers.dev-db.entrypoints: websecure  
      traefik.http.routers.dev-db.service: dev-db     
      traefik.http.services.dev-db.loadbalancer.server.port: "5432"
      traefik.docker.network: "proxy"
    restart: always
    
networks:  
  proxy:    
    name: proxy    
    external: true
  private-network:
    name: private-network

```

---

<div class="post-metadata">

**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\
**Post date:** [June 12, 2023, 2:20pm UTC](https://community.traefik.io/t/forward-http-s-to-postgresql-container-in-docker-swarm-compose-possible/18938/2 "2023-06-12T14:20:15Z")

</div>

Postgres might use TLS, but pretty sure it does not use http, so you would need to use a TCP router.

---

<div class="post-metadata">

**Author:** ![gerrga](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/gerrga/32/4163_2.png) [@gerrga](https://community.traefik.io/u/gerrga)\
**Post date:** [June 13, 2023, 6:26am UTC](https://community.traefik.io/t/forward-http-s-to-postgresql-container-in-docker-swarm-compose-possible/18938/3 "2023-06-13T06:26:55Z")

</div>

Hello, thank you for your quick answer. I will move forward with the tcp.

One remaining question what I have

is

> traefik.docker.network: "proxy"

the way to expose the 5432 from non-traefik network via traefik? because my postgres will sit in the non-proxy network

---

<div class="post-metadata">

**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\
**Post date:** [June 13, 2023, 6:39am UTC](https://community.traefik.io/t/forward-http-s-to-postgresql-container-in-docker-swarm-compose-possible/18938/4 "2023-06-13T06:39:13Z")

</div>

Traefik and target service should use the same Docker network, as Traefik Docker Configuration Discovery (with labels) is using the Docker network IPs.

You explicitly need to state the network when your target uses multiple networks and only one is shared with Traefik.

If your target service is not in a Docker network, then you need to set the service with `loadbalancer.servers.url`. This can’t be done with labels, but you need a separate dynamic config file, loaded via `provider.file` in static config.

---

<div class="post-metadata">

**Author:** ![gerrga](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/gerrga/32/4163_2.png) [@gerrga](https://community.traefik.io/u/gerrga)\
**Post date:** [June 13, 2023, 7:44am UTC](https://community.traefik.io/t/forward-http-s-to-postgresql-container-in-docker-swarm-compose-possible/18938/5 "2023-06-13T07:44:00Z")

</div>

My postgres service also in the docker network.  
In my example above my docker compose has 2 networks.

1. Proxy-network - Traefik sitting in that
2. Private-network - Postgresql sitting in that with some other containers what not mentioned in my example.  
So I want only expose the Postgresql:5432 from Private-network via the Traefik what is in the Proxy-network.  
All of them in the docker-compose.

So the easy way is to add the proxy network also to my postgresql networks?

---

<div class="post-metadata">

**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\
**Post date:** [June 13, 2023, 7:50am UTC](https://community.traefik.io/t/forward-http-s-to-postgresql-container-in-docker-swarm-compose-possible/18938/6 "2023-06-13T07:50:52Z")

</div>

Yes, if you want Postgres to be reachable by Traefik, you need to add the proxy network, too. Then Postgres has 2 networks, you need to add `docker.network` in static or dynamic (labels) config for Traefik.

---

<div class="post-metadata">

**Author:** ![gerrga](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/gerrga/32/4163_2.png) [@gerrga](https://community.traefik.io/u/gerrga)\
**Post date:** [June 13, 2023, 12:27pm UTC](https://community.traefik.io/t/forward-http-s-to-postgresql-container-in-docker-swarm-compose-possible/18938/7 "2023-06-13T12:27:25Z")

</div>

I set the changes. I think everything is good but I can not reach the postgres  
Extended the config

```auto
EntryPoints:
  web:
    address: :80
    # (Optional) Redirect to HTTPS
    # ---
    http:
      redirections:
        entryPoint:
          to: websecure
          scheme: https
  websecure:
    address: :443
  postgres-db:
    address: :5432

```

Changed the compose traefik

```auto

version: '3.7'
services:

  reverse-proxy:
    container_name: traefik

    # The official v2 Traefik docker image
    image: traefik:v2.8
    ports:
      # The HTTP port
      - "80:80"
      - "443:443"
      - "5432:5432"
    volumes:
      # So that Traefik can listen to the Docker events
      - /var/run/docker.sock:/var/run/docker.sock
      - /docker/traefik/config:/etc/traefik
      - /docker/traefik/certs/:/etc/traefik/certs
      - /docker/traefik/log/:/var/log/traefik

    networks:
      - proxy

    restart: always

networks:
  proxy:
    name: proxy

```

And ofcourse changed the labels and the network  
version: "3.7"  
services:  
db:  
image: postgres:14

```
environment:
  - POSTGRES_DB=mydb
  - POSTGRES_USER=postgres
  - POSTGRES_PASSWORD=postgres
networks:
  - private-network
  - proxy
labels:      
  traefik.enable: 'true'      
  traefik.docker.network: "proxy"
  traefik.tcp.routers.dev-db.rule: HostSNI(`myhost-name`)      
  traefik.tcp.routers.dev-db.entrypoints: postgres-db
  traefik.tcp.routers.dev-db.service: dev-db   
  traefik.tcp.routers.dev-db.tls: "true"     
  traefik.tcp.services.dev-db.loadbalancer.server.port: "5432"

restart: always

```

networks:  
proxy:  
name: proxy  
external: true  
private-network:  
name: private-network

I have no idea where is the error. I set the logs to debug but doesnt help. It goes to timeout

---

<div class="post-metadata">

**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\
**Post date:** [June 13, 2023, 12:41pm UTC](https://community.traefik.io/t/forward-http-s-to-postgresql-container-in-docker-swarm-compose-possible/18938/8 "2023-06-13T12:41:24Z")

</div>

Do you know what you are doing? Does Postgres support TLS? Is your client set up to use TLS? Is your DB set up to use TLS? Will it create a custom certificate?

If you have not loaded custom TLS certs in Traefik using `tls: true`, Traefik will create custom certs which your client will probably not trust. For a trusted cert you would need paid certs, LetsEncrypt or import the custom certs on client side.

I would just remove that line and have a plain TCP/IP connection proxied from the client to your DB, without Traefik interfering with TLS. Let client and DB do the encryption, make sure it is enabled.

Note that you then need to use `HostSNI(`*`)`, as Traefik can not look inside a TLS connection without having the cert available.

---

<div class="post-metadata">

**Author:** ![gerrga](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/gerrga/32/4163_2.png) [@gerrga](https://community.traefik.io/u/gerrga)\
**Post date:** [June 13, 2023, 12:56pm UTC](https://community.traefik.io/t/forward-http-s-to-postgresql-container-in-docker-swarm-compose-possible/18938/9 "2023-06-13T12:56:49Z")

</div>

Hello,  
Yes I know. I wont say I'm an expert but thatswhy Im here 🙂

Postgresql uses TLS.  
I have a trusted ,payed certificate what im using in Traefik.  
So this should not be the problem.  
HostSNI(`*`) is not an option because I would use multiple postgresql on the machine behind traefik connected to different domain names.

---

<div class="post-metadata">

**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\
**Post date:** [June 13, 2023, 2:18pm UTC](https://community.traefik.io/t/forward-http-s-to-postgresql-container-in-docker-swarm-compose-possible/18938/10 "2023-06-13T14:18:43Z")

</div>

I don’t know how Postgres handles TLS. You can try to use your paid certs with Postgres, too, and use `tls.passthrough=true`. Or let Postgres create its own proprietary cert and use `insecureSkipVerify: true` on global or service level.

---

<div class="post-metadata">

**Author:** ![gerrga](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/gerrga/32/4163_2.png) [@gerrga](https://community.traefik.io/u/gerrga)\
**Post date:** [June 16, 2023, 12:14pm UTC](https://community.traefik.io/t/forward-http-s-to-postgresql-container-in-docker-swarm-compose-possible/18938/11 "2023-06-16T12:14:13Z")

</div>

still not working.  
if I put the

```auto
tls.passthrough: false
HostSNI(`*`)
tls: false

```

it works but if I switch one of that to true or define a hostname its not working.

I set the  
`insecureSkipVerify: true` also.

But the postrgresql is running with TLS because If I connect with the Traefik setup above I can make the SSL connection.

```auto
psql (14.8 (Ubuntu 14.8-0ubuntu0.22.04.1), server 14.7 (Debian 14.7-1.pgdg110+1))
SSL connection (protocol: TLSv1.3, cipher: TLS_AES_256_GCM_SHA384, bits: 256, compression: off)
Type "help" for help.

```

Any idea?

---

<div class="post-metadata">

**Author:** ![gerrga](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/gerrga/32/4163_2.png) [@gerrga](https://community.traefik.io/u/gerrga)\
**Post date:** [June 16, 2023, 4:09pm UTC](https://community.traefik.io/t/forward-http-s-to-postgresql-container-in-docker-swarm-compose-possible/18938/12 "2023-06-16T16:09:44Z")

</div>

I was thinking to reach the following scenario. This is exactly what I would do but on the same machine with docker-compose and traefik

> <https://stackoverflow.com/questions/61113433/is-it-possible-to-redirect-a-tcp-connection-based-on-host-name>