Connecting to Postgres with a static IP from a Python app on Render

Recommended setup

Use Fixie Socks proxy for Postgres connections to a database that only accepts traffic from approved IP addresses. Store the proxy value in FIXIE_SOCKS_HOST, then configure Python to route outbound traffic through Fixie before connecting to Postgres.

Set up Fixie on Render

Create a Fixie Socks proxy in the Fixie dashboard. Copy the proxy value into Render Environment Variables as FIXIE_SOCKS_HOST, and copy the outbound IPs into the destination allowlist.

Implementation

The example below shows the core application-side change. Keep credentials in environment variables and avoid committing proxy, database, or API secrets.

Forward a local port to Postgres through Fixie Socks

# Install Fixie-Wrench in your app build or deploy process.
/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/usefixie/fixie-wrench/HEAD/install.sh)"

# Start a tunnel from localhost:5432 to postgres.example.com:5432.
# Your Python app connects to localhost:5432; Fixie handles the outbound static IP.
./bin/fixie-wrench 5432:postgres.example.com:5432

Good to know

• Set the start command to launch both processes: ./bin/fixie-wrench 5432:postgres.example.com:5432 & gunicorn app:server.
• Add the Fixie-Wrench install one-liner to your build command so the binary is present at runtime.

Allowlist and test the static IPs

1. Open the Fixie dashboard and copy the outbound IP addresses for this proxy.
2. Add both IPs to the Postgres firewall or security group.
3. Deploy the updated Python app on Render.
4. Run a small connection test before sending production traffic.

Related guides

• Making API requests with a static IP from a Python app on Render
• Connecting to Postgres with a static IP from a Python app on Heroku
• Connecting to Postgres with a static IP from a Node app on Render

Related docs

• Python implementation examples
• Render setup documentation
• Postgres connection guide
• Fixie-Wrench for TCP forwarding