Keep PostgreSQL off the public internet by separating a public edge, a private Rails application tier, and a private database tier. Let the app reach the database over the private network, and give operators a separate, temporary SSH path through a tightly restricted bastion. For administration, use a local SSH forward bound to 127.0.0.1, verify every hop’s encryption, and close the tunnel when the task ends.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
The secure three-tier layout
A three-tier deployment has three distinct trust zones:
As an Amazon Associate I earn from qualifying purchases.
Recommended Free Tools
- Edge tier: a public reverse proxy or load balancer that accepts HTTPS and forwards only the application traffic you intend to publish.
- Rails tier: application servers on private addresses. They accept requests from the edge and make database connections over the provider’s private network.
- Database tier: PostgreSQL on a private address with no public listener or public proxy enabled.
Operators should not turn the database into a fourth public-facing service just to run a migration or inspect records. Instead, create a separate administrative route through a bastion host or a provider-managed SSH endpoint. The bastion needs reachability only to the internal service ports required for the job.
| Flow | Allowed source | Destination | Purpose |
|---|---|---|---|
| Internet to edge | Public clients | HTTPS listener on the edge | Published web traffic |
| Edge to Rails | Edge tier | Private Rails service port | Forwarded application requests |
| Rails to PostgreSQL | Rails servers or service identity | Private PostgreSQL port, normally 5432 | Application queries and transactions |
| Operator tunnel | Authorized operator key | Bastion or provider SSH endpoint, then one approved internal port | Temporary maintenance access |
A working operator tunnel does not prove that Rails itself is authorized correctly. Test the application-to-database path independently, because network reachability, database authentication, and Rails authorization are separate controls.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
What an SSH tunnel protects—and what it does not
Local port forwarding makes an SSH client listen on a port on your workstation and carry connections through the SSH session to a target visible from the SSH server. PostgreSQL’s documentation describes the pattern as a way to encrypt the connection between a client and a PostgreSQL server, using a command such as:
ssh -L 63333:localhost:5432 [email protected]
psql -h localhost -p 63333 postgresThe local port, 63333 in this example, is arbitrary. The word localhost on the right side is resolved from the SSH server’s point of view, not from your laptop. If the SSH server is the database host, it means that host’s loopback interface. If the SSH server is a bastion, it means the bastion itself.
A tunnel can therefore stop short of the database. PostgreSQL’s documentation also shows a hop such as:
ssh -L 63333:db.foo.com:5432 [email protected]Here, your laptop-to-shell.foo.com connection is protected by SSH, but the subsequent connection from shell.foo.com to db.foo.com is not encrypted by that SSH session. To protect that second leg, terminate SSH on the database host, create another protected channel, or use an authenticated encrypted private network for the east-west connection. Never describe a bastion as automatically encrypting every segment.
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
Oracle’s bastion guidance uses the same model: port forwarding creates a secure connection between a client port and a target port and can carry protocols such as MySQL and RDP. For Rails operations, narrow the target to the PostgreSQL port or the specific internal service needed for the task rather than granting broad network access.
Prepare the network and identities
Put only the edge on the public path
- Assign private addresses to the Rails services and PostgreSQL.
- Expose only the edge listener to the internet.
- Allow the edge to reach the Rails service port, and allow the Rails tier to reach PostgreSQL on its database port.
- Deny unsolicited inbound traffic to the application and database tiers.
Keep the database’s normal application connection on the private route. Do not enable a public database proxy as a shortcut for administration. A public proxy creates a separate internet-facing path that must be defended, monitored, and removed when no longer needed.
Create a dedicated bastion or provider SSH endpoint
Use a host or managed endpoint whose only job is controlled administrative entry. Give it a private route to the database or internal service, but no unnecessary access to unrelated production systems. Separate operator identities and keys from application credentials. Remove unused keys, review access logs, and expire short-lived access after maintenance.
Constrain forwarding at the SSH server
On the bastion, restrict AllowTcpForwarding and the destinations that each identity may reach. A tunnel-only account should not receive an interactive shell when the platform permits disabling it. Limit forwarding to the required destination address and port; an account that needs PostgreSQL access does not also need arbitrary forwarding to every private host.
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
Protect the operator workstation
Choose an unused high local port and bind the listener to loopback. Binding to all interfaces can accidentally make the forwarded database available to other devices on your local network. Keep PostgreSQL credentials and Rails secrets in the normal secret store, not in shell history, copied commands, source control, or chat messages.
Open a fail-closed local PostgreSQL tunnel
A practical operator command is:
ssh -N -T -o ExitOnForwardFailure=yes
-L 127.0.0.1:63333:127.0.0.1:5432
[email protected]-Nkeeps the SSH session for forwarding only; it does not request a remote command.-Tdisables pseudo-terminal allocation, which is appropriate for a non-interactive tunnel.-o ExitOnForwardFailure=yesmakes the client exit if it cannot establish the requested forward instead of leaving you with a session that appears connected but cannot carry traffic.-L 127.0.0.1:63333:127.0.0.1:5432binds the local listener to loopback port 63333 and sends traffic to port 5432 on the SSH server’s loopback interface.
Replace the right-hand target with the database’s private hostname or address when the bastion is not the database host. The target must be reachable from the bastion, and the bastion’s firewall and SSH policy must permit that exact destination.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Connect a command-line client
Leave the tunnel process running, then point psql at the local endpoint:
psql -h 127.0.0.1 -p 63333 -U your_database_user -d your_database_nameSupply the password through your approved secret mechanism rather than placing it in the command line. When the administrative task is complete, stop the SSH process with Ctrl-C or close its terminal. The local port should no longer accept connections.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
Connect a GUI client
Configure the GUI with host 127.0.0.1, port 63333, the normal database name and user, and credentials from the secret store. Do not enter the bastion hostname as the database host: the GUI is connecting to the local end of the forward.
Configure Rails to use the private database path
Rails production processes should connect directly to PostgreSQL over the private network, not through an operator’s laptop tunnel. Set the database host to the private DNS name or private address supplied by your network, and keep the port at the database service port unless your deployment intentionally changes it.
Free tools Windows power users keep installed
One-click scans. No signup required.
Store the username, password, database name, and Rails encryption secrets in the platform’s secret manager or environment configuration. A tunnel is a transport path; it does not replace PostgreSQL authentication, Rails credentials, authorization checks, or least-privilege database roles.
Verify the application path separately
- From a Rails runtime environment, resolve the private database hostname.
- Check that the network policy permits the Rails service identity to reach TCP port 5432.
- Run a Rails health check or a controlled database command using the production configuration.
- Confirm that the database role can perform only the operations the application requires.
- Review application and database logs for authentication failures, rejected connections, and unexpected source addresses.
Do not infer application correctness from a successful operator tunnel. The operator may use a different identity, source network, or database role than the Rails process.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
Use provider private networking when it is available
Some hosting platforms keep services in an environment-level private network. Railway documents private networking based on encrypted WireGuard tunnels, internal DNS, and traffic that remains within the provider’s infrastructure. Its documentation lists TCP database traffic as supported and describes isolation between environments. That protects routing and transport between services; Rails still needs strong authentication, authorization, safe secret handling, and database least privilege.
Railway states that PostgreSQL databases are private by default. Enabling public access creates a TCP Proxy and a public connection path, so leave public access disabled unless a documented requirement justifies it. For operator access, its railway connect command supports --ssh and --tunnel-only; the command opens a local tunnel and prints connection details for psql or a GUI while the tunnel remains open.
The same design principle applies on other providers: use the private service name for Rails-to-PostgreSQL traffic, and use a provider SSH endpoint or bastion only for temporary operator access. Confirm exactly which hops the provider encrypts and which destinations its forwarding feature permits.
Choose among common access designs
| Design | Public exposure | Encryption coverage | Identity and audit | Failure behavior |
|---|---|---|---|---|
| Direct public PostgreSQL | Database is directly reachable or exposed through a public proxy | Depends on database TLS and client configuration for every connection | Must be enforced at the database and network perimeter; broad attack surface | Database remains reachable even when the bastion is unavailable |
| Private database plus bastion local forward | No database exposure; SSH endpoint is public or otherwise reachable by operators | SSH protects the operator-to-SSH-server leg; the next leg needs its own protection or trusted encrypted private network | Per-operator SSH keys, forwarding restrictions, and bastion logs provide a focused audit path | Administrative access fails closed when the bastion or requested forward is unavailable; application traffic can continue privately |
| Private provider network plus managed SSH tunnel | Database remains private; provider SSH endpoint handles operator entry | Provider private-network transport and the SSH tunnel cover their respective paths; verify the provider’s exact boundary | Provider identity, project membership, command logs, and database credentials must all be reviewed | Operator access depends on the provider endpoint, while the Rails service-to-database path remains separate |
Evaluate a design on seven questions: Is the database publicly exposed? Is every hop protected? How are keys and identities issued, rotated, and revoked? Which forwarding destinations are allowed? What evidence is logged? How complex is day-to-day operation? What continues to work when the bastion or tunnel is down?
Harden the bastion and tunnel workflow
- Use separate operator accounts: never share one private key among the team. Map each person to an identifiable account or identity.
- Keep forwarding narrow: permit only the database or internal service port required for the task.
- Disable shells for tunnel-only users: remove command execution where the SSH platform supports a forwarding-only account.
- Bind local listeners to loopback: use
127.0.0.1, not an all-interfaces address. - Fail closed: keep
ExitOnForwardFailure=yesso a failed forward cannot be mistaken for a usable session. - Use short-lived access: expire temporary keys or project membership after maintenance.
- Review logs: inspect SSH authentication and forwarding events, bastion network logs, PostgreSQL connection logs, and Rails audit records.
- Keep secrets out of commands: use a secret manager or interactive credential mechanism instead of command-line passwords.
- Separate maintenance from production traffic: a migration tunnel should not become the normal route for Rails requests.
- Close every temporary tunnel: an idle forwarding session is still an active access path.
Troubleshoot by locating the failed hop
| Symptom | Likely boundary | Checks | Remedy |
|---|---|---|---|
ssh exits immediately with a forwarding error |
Local bind or SSH forwarding setup | Check whether port 63333 is already in use and inspect the SSH error with verbose logging | Choose an unused local port, confirm the account may forward, and retain ExitOnForwardFailure=yes |
SSH connects but psql reports connection refused |
Target side of the forward | Confirm the right-hand host and port are reachable from the bastion and that PostgreSQL listens on the intended private interface | Correct the target address, firewall rule, or database listener; do not expose PostgreSQL publicly as a workaround |
psql reaches PostgreSQL but authentication fails |
Database credentials or role policy | Verify database name, user, password source, and allowed client address | Fix the secret or role mapping. A successful tunnel does not grant database permission |
| Rails cannot connect while the operator tunnel works | Application-to-database path | Test private DNS, service egress rules, credentials, and Rails environment settings from the Rails runtime | Repair the private route or application configuration independently of the operator tunnel |
| Another device can connect to the forwarded port | Local listener bound too broadly | Inspect the SSH command and local socket address | Bind the forward explicitly to 127.0.0.1 and close the exposed session |
| Traffic between bastion and database must meet encryption requirements | Unprotected second hop | Determine whether the private network is authenticated and encrypted and whether PostgreSQL TLS is enabled | Terminate SSH on the database, add a second protected channel, or use an authenticated encrypted private network |
Diagnose in order: local listener, SSH authentication, bastion reachability, target service listener, database authentication, and finally application authorization. This sequence prevents changing Rails settings when the failure is actually a blocked bastion route.
Operational runbook
Before maintenance
- Confirm the ticket, operator identity, target environment, database role, and exact destination port.
- Check that the database remains private and that the bastion policy allows only the intended forward.
- Choose a free local port and start the tunnel with loopback binding and fail-closed behavior.
- Record the start time and change or ticket identifier in the normal audit system.
During maintenance
- Connect clients only to
127.0.0.1and the chosen local port. - Use the least-privileged database role that can complete the task.
- Keep the tunnel terminal visible or managed by an approved session tool so its lifetime is apparent.
- Stop if the target hostname, port, or identity differs from the approved plan.
After maintenance
- Close the SSH process and verify that the local port is no longer listening.
- Revoke or expire temporary keys, project access, or bastion permissions.
- Review SSH, provider, database, and application logs for the maintenance window.
- Store migration output and change evidence according to your normal operational policy.
Security properties and limits
SSH forwarding provides confidentiality and integrity for the encrypted SSH leg and gives administrators a controlled way to reach a private service. It does not decide who may query PostgreSQL, validate Rails authorization, rotate credentials, or encrypt a later network hop automatically. Private networking can keep traffic inside a provider and protect it with encrypted WireGuard tunnels, but it likewise does not remove the need for service authentication and least privilege.
The strongest arrangement is therefore layered: public exposure limited to the edge, private east-west routing for Rails and PostgreSQL, narrowly scoped SSH forwarding for humans, independent database authentication, and logs that connect each administrative action to an individual identity.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
