Connect databases through a static IP

// Uses socksDialer() from the Go guide.
func connectPostgres(ctx context.Context) (*pgxpool.Pool, error) {
	dialer, err := socksDialer()
	if err != nil {
		return nil, err
	}
	cfg, err := pgxpool.ParseConfig(os.Getenv("DATABASE_URL"))
	if err != nil {
		return nil, err
	}
	// pgx still runs TLS against the host name in DATABASE_URL.
	cfg.ConnConfig.DialFunc = dialer.DialContext
	return pgxpool.NewWithConfig(ctx, cfg)
}

# Planned: bm tunnel 5432:db.example.com:5432 running beside your app.
# host= is the name checked against the server certificate.
# hostaddr= is where libpq actually connects: the local tunnel.
psql "host=db.example.com hostaddr=127.0.0.1 port=5432 \
      dbname=app user=app sslmode=verify-full"

// Planned: bm tunnel 5432:db.example.com:5432 running beside your app.
import pg from "pg";

const pool = new pg.Pool({
  host: "127.0.0.1",
  port: 5432,
  user: "app",
  password: process.env.DB_PASSWORD,
  database: "app",
  // Check the certificate against the real server name, not 127.0.0.1.
  ssl: { servername: "db.example.com" },
  // Close idle clients before the proxy's idle timeout (planned: 5 minutes).
  idleTimeoutMillis: 60_000,
});

// Uses socksDialer() from the Go guide.
func openMySQL() (*sql.DB, error) {
	dialer, err := socksDialer()
	if err != nil {
		return nil, err
	}
	mysql.RegisterDialContext("fixedmark",
		func(ctx context.Context, addr string) (net.Conn, error) {
			return dialer.DialContext(ctx, "tcp", addr)
		})
	// The network name in the DSN selects the dialer:
	// app:secret@fixedmark(mysql.example.com:3306)/app?tls=true
	return sql.Open("mysql", os.Getenv("MYSQL_DSN"))
}

# Planned: bm tunnel 3306:mysql.example.com:3306 running beside your app.
# VERIFY_IDENTITY would compare the certificate with 127.0.0.1 and fail.
# VERIFY_CA still checks the certificate chain.
mysql --host=127.0.0.1 --port=3306 --user=app -p \
      --ssl-mode=VERIFY_CA --ssl-ca=ca.pem app

// npm install mongodb socks
import { MongoClient } from "mongodb";

const socks = new URL(process.env.FIXEDMARK_SOCKS_URL);

const client = new MongoClient(process.env.MONGODB_URI, {
  proxyHost: socks.hostname,
  proxyPort: Number(socks.port),
  proxyUsername: decodeURIComponent(socks.username),
  proxyPassword: decodeURIComponent(socks.password),
});
await client.connect();

// Uses socksDialer() from the Go guide. go-redis skips its own TLS
// when you set Dialer, so wrap the connection in TLS here.
func newRedis() (*redis.Client, error) {
	dialer, err := socksDialer()
	if err != nil {
		return nil, err
	}
	opt, err := redis.ParseURL(os.Getenv("REDIS_URL")) // rediss://...
	if err != nil {
		return nil, err
	}
	tlsCfg := opt.TLSConfig
	opt.Dialer = func(ctx context.Context, network, addr string) (net.Conn, error) {
		conn, err := dialer.DialContext(ctx, network, addr)
		if err != nil || tlsCfg == nil {
			return conn, err
		}
		return tls.Client(conn, tlsCfg), nil
	}
	return redis.NewClient(opt), nil
}

# Planned: bm tunnel 6380:redis.example.com:6380 running beside your app.
# Pass the real host name for TLS SNI and certificate checks.
redis-cli -h 127.0.0.1 -p 6380 --tls --sni redis.example.com PING