Documentation +

Static IP guide

Connecting to MySQL with a static IP from a Ruby app on Heroku

The mysql2 gem has no native SOCKS support, so the Heroku pattern for reaching an allowlisted MySQL server from Ruby is port-forwarding: Fixie-Wrench listens on localhost:3306 and relays every byte through Fixie Socks to the real server. Grants and firewall rules then only ever need Fixie's two addresses.

RuntimeRuby
PlatformHeroku
DestinationMySQL
Fixie productFixie Socks Heroku add-on

Recommended setup

Use Fixie Socks Heroku add-on for MySQL or MariaDB connections from a dynamic hosting platform. Store the proxy value in FIXIE_SOCKS_HOST, then configure Ruby to route outbound traffic through Fixie before connecting to MySQL.

Set up Fixie on Heroku

Heroku is a native Fixie marketplace flow. Install the Fixie Socks Heroku add-on or attach it from the Heroku CLI. Heroku will create FIXIE_SOCKS_HOST as a config var for the app.

Attach fixie-socks to your Heroku app

heroku addons:create fixie-socks
heroku config:get FIXIE_SOCKS_HOST

Implementation

The example below shows the core application-side change. Keep credentials in environment variables and avoid committing proxy, database, or API secrets.

Forward a local port to MySQL through Fixie Socks

# Install Fixie-Wrench in your app build or deploy process.
/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/usefixie/fixie-wrench/HEAD/install.sh)"

# Start a tunnel from localhost:3306 to mysql.example.com:3306.
# Your Ruby app connects to localhost:3306; Fixie handles the outbound static IP.
./bin/fixie-wrench 3306:mysql.example.com:3306

Good to know

  • In database.yml use host: 127.0.0.1, port: 3306 — everything else stays as if you connected directly.
  • If your MySQL user is restricted by host, update the grant to match the Fixie IPs the server now sees instead of the old application address.

Allowlist and test the static IPs

  1. Open the Fixie dashboard and copy the outbound IP addresses for this proxy.
  2. Add both IPs to the MySQL firewall or security group.
  3. Deploy the updated Ruby app on Heroku.
  4. Run a small connection test before sending production traffic.

Related guides

Related docs