---
title: TCP proxy
description: Give a PostgreSQL or Redis database a public host and port so you can connect from your own machine.
section: Networking
order: 3
---

A TCP proxy gives a PostgreSQL or Redis database a public host and port that forward raw TCP to it, so you can connect from `psql`, `redis-cli` or a desktop client on your own machine. It's off by default.

## Turn on the TCP proxy

Open the database's **Settings**, turn on **Public TCP proxy**, choose **Stage changes**, then **Deploy changes**. Dekka opens a port between 10000 and 60000 that stays the same for that database.

> [!WARNING]
> Anyone with the database's credentials can connect through the proxy from anywhere. Turn it off when you no longer need it, and [rotate the credentials](/docs/postgresql#rotate-credentials) if they may have leaked.

## Find the proxy's address

The dashboard doesn't show the address yet. Read it from the database's `observed.endpoints` in the API, where it appears with `kind` set to `tcp_proxy`:

```bash tab="cURL"
curl https://api.dekka.cloud/v1/resources/$DATABASE_ID \
  -H "Authorization: Bearer $DEKKA_API_KEY"
```

```json title="Response, abridged"
{
  "observed": {
    "endpoints": [
      { "kind": "tcp_proxy", "hostname": "proxy.gh-1.apps.dekka.cloud", "port": 24817, "url": "tcp://proxy.gh-1.apps.dekka.cloud:24817" }
    ]
  }
}
```

## Connect through the proxy

Take the user, password and database name from a connected service's `DATABASE_URL` or `REDIS_URL`, which you can reveal on the **Environment** tab, and swap in the proxy's host and port. Credentials only exist for connected services, so connect one first if nothing uses the database yet.

```bash tab="PostgreSQL"
psql "postgresql://<user>:<password>@proxy.gh-1.apps.dekka.cloud:24817/<database>?sslmode=require"
```

```bash tab="Redis"
redis-cli -u "rediss://default:<password>@proxy.gh-1.apps.dekka.cloud:24817"
```