Documentation +

Static IP guide

Connecting to Postgres with a static IP from a Ruby app on Heroku

When a Rails app on Heroku must reach a Postgres database behind an IP allowlist — a client's warehouse, an RDS instance in another account — the cleanest path is a Fixie-Wrench tunnel. ActiveRecord keeps its normal configuration; only the host changes, to 127.0.0.1, where the tunnel listens and relays through Fixie Socks.

RuntimeRuby
PlatformHeroku
DestinationPostgres
Fixie productFixie Socks Heroku add-on

Recommended setup

Use Fixie Socks Heroku add-on for Postgres connections to a database that only accepts traffic from approved IP addresses. Store the proxy value in FIXIE_SOCKS_HOST, then configure Ruby to route outbound traffic through Fixie before connecting to Postgres.

Set up Fixie on Heroku

Heroku is a native Fixie marketplace flow. Install the Fixie Socks Heroku add-on or attach it from the Heroku CLI. Heroku will create FIXIE_SOCKS_HOST as a config var for the app.

Attach fixie-socks to your Heroku app

heroku addons:create fixie-socks
heroku config:get FIXIE_SOCKS_HOST

Implementation

The example below shows the core application-side change. Keep credentials in environment variables and avoid committing proxy, database, or API secrets.

Forward a local port to Postgres through Fixie Socks

# Install Fixie-Wrench in your app build or deploy process.
/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/usefixie/fixie-wrench/HEAD/install.sh)"

# Start a tunnel from localhost:5432 to postgres.example.com:5432.
# Your Ruby app connects to localhost:5432; Fixie handles the outbound static IP.
./bin/fixie-wrench 5432:postgres.example.com:5432

Good to know

  • Launch the tunnel in the same dyno command: web: ./bin/fixie-wrench 5432:postgres.example.com:5432 & bundle exec puma.
  • In database.yml set host: 127.0.0.1 and keep username, password, and sslmode as they were — TLS negotiates with the real server through the tunnel.
  • Connection pools verify and re-establish dropped connections on checkout, which covers tunnel restarts during dyno cycling.

Allowlist and test the static IPs

  1. Open the Fixie dashboard and copy the outbound IP addresses for this proxy.
  2. Add both IPs to the Postgres firewall or security group.
  3. Deploy the updated Ruby app on Heroku.
  4. Run a small connection test before sending production traffic.

Related guides

Related docs