Skip to main content
Query Render Postgres over Tailscale. Do not add a laptop IP under Access Control on the database. Engineer access stays on Tailscale. An allowlist entry publishes the database on the public internet. Test and sandbox run on PlanetScale, not Render Postgres. Every instance on the account uses the same private-network suffix.
These instances hold live data. Confirm the database name before running anything that writes. Use a read replica when you only need to inspect rows.

​
Render

​
Prerequisites

  • Tailscale is connected to the company tailnet, with Tailscale DNS enabled. The hostname below resolves only through that DNS.
  • Access to the database in the Render Dashboard.

​
1. Copy the internal credentials

On the instance’s Connect or Info page, copy the internal user, password, port, and database name. The internal host is a bare id such as dpg-xxxxxxxx-c. The trailing letter is part of the id and differs per instance, so copy the whole thing from the page you are on. Do not use the external hostname (*.render.com).

​
2. Build the Tailscale hostname

Append .usr-cgvspcgdh87jokuesjfg.svc.cluster.local to that id:
Each read replica has its own dpg- id. Use that id with the same .usr-...svc.cluster.local suffix.

​
3. Connect

Use the internal port, 5432. Leave SSH tunneling off.
psql prompts for the password. TablePlus and Postico take the same host, port, user, and database. Production application data is the database name in the production service’s internal URL.

​
PlanetScale

Credentials are in 1Password in the Engineering Team. Connect over Tailscale to db.internal.polar.sh, db.internal.sandbox.polar.sh or db.internal.test.polar.sh with sslmode=require.