Documentation +

Static IP guide

Connecting to an SFTP server with a static IP from a Ruby app on Heroku

Ruby is the one stack where SFTP over Fixie needs no helper process: net-sftp rides on net-ssh, which ships a SOCKS5 proxy class. Parse FIXIE_SOCKS_HOST, hand the proxy object to Net::SFTP.start, and your Heroku app exchanges files with allowlisted SFTP servers directly from Ruby code.

RuntimeRuby
PlatformHeroku
DestinationSFTP
Fixie productFixie Socks Heroku add-on

Recommended setup

Use Fixie Socks Heroku add-on for SFTP transfers or SSH-based file workflows that require a fixed source IP. Store the proxy value in FIXIE_SOCKS_HOST, then configure Ruby to route outbound traffic through Fixie before connecting to SFTP.

Set up Fixie on Heroku

Heroku is a native Fixie marketplace flow. Install the Fixie Socks Heroku add-on or attach it from the Heroku CLI. Heroku will create FIXIE_SOCKS_HOST as a config var for the app.

Attach fixie-socks to your Heroku app

heroku addons:create fixie-socks
heroku config:get FIXIE_SOCKS_HOST

Implementation

The example below shows the core application-side change. Keep credentials in environment variables and avoid committing proxy, database, or API secrets.

Connect to SFTP through FIXIE_SOCKS_HOST

require "net/sftp"
require "net/ssh/proxy/socks5"

proxy_uri = URI.parse("socks://#{ENV.fetch("FIXIE_SOCKS_HOST")}")
socks_proxy = Net::SSH::Proxy::SOCKS5.new(
  proxy_uri.host,
  proxy_uri.port,
  user: proxy_uri.user,
  password: proxy_uri.password,
)

Net::SFTP.start("sftp.example.com", "deploy", proxy: socks_proxy) do |sftp|
  sftp.download!("/remote/path/report.csv", "report.csv")
end

Good to know

  • FIXIE_SOCKS_HOST has no URI scheme, so prefix socks:// before URI.parse — the snippet does this — or the host and credentials will not parse.
  • SFTP is a single SSH connection on port 22, so there is none of the multi-connection complexity of classic FTP; one proxied socket carries the whole session.
  • Banking and payroll SFTP drops usually allowlist per-IP: register both Fixie addresses before the first production transfer.

Allowlist and test the static IPs

  1. Open the Fixie dashboard and copy the outbound IP addresses for this proxy.
  2. Add both IPs to the SFTP server firewall.
  3. Deploy the updated Ruby app on Heroku.
  4. Run a small connection test before sending production traffic.

Related guides

Related docs

Is this guide useful?