Public TCP

Domains carry HTTP traffic only. To reach a database or another non-HTTP service from outside Fjordrun, for example from your laptop, a BI tool or a game client, turn on public TCP for one of its ports. Fjordrun gives it a port on the shared host tcp.fjordrun.app:

tcp.fjordrun.app:20345  ->  port 5432 of your Postgres service

Public TCP needs the Hobby plan or higher and is available for web, worker and database services.

Turn it on

1. Open the service, then Settings → Networking → Public TCP.
2. Enter the port the service listens on (for example 5432 for PostgreSQL) and choose Enable public TCP.
3. Copy the host:port shown. It works within about a minute.

The port number is assigned by Fjordrun from the range 20000-29999 and stays the same until you turn public TCP off. Each environment of a service gets its own port. A service can have up to 5 public ports.

With the API: POST /api/v1/services/{id}/tcp-proxy with {"target_port": 5432} returns a Public TCP port object.

Connect to Postgres from your laptop

For a database created from a template, the dashboard shows a ready-made Connection string under Public TCP (and as Public connection URL in the database's login details). It is the private connection URL with the public host and port:

psql "postgresql://postgres:<password>@tcp.fjordrun.app:20345/fjordrun"

The same works for the other engines:

mysql -h tcp.fjordrun.app -P 20346 -u root -p fjordrun
redis-cli -u "redis://default:<password>@tcp.fjordrun.app:20347"
mongosh "mongodb://mongo:<password>@tcp.fjordrun.app:20348"

GUI clients (TablePlus, DBeaver, pgAdmin, DataGrip) take the same host, port, user, password and database.

Your own services in Fjordrun should keep using the private hostname (${{Postgres.DATABASE_URL}}): it is faster, not exposed to the internet, and not billed as egress.

Security

A public port can be reached by anyone on the internet, and port ranges like this one are scanned constantly. The proxy forwards bytes; it does not add authentication or encryption.

• Use strong passwords. Templates generate a random 32-character password. Don't replace it with a short one, and never keep a database's default or empty password on a public port.
• Turn it off when you don't need it. Use public TCP for an import, a debugging session or a client that really needs it, then disable it. When you enable it again you get a new port number.
• Prefer encrypted protocols. Fjordrun's database templates speak plain TCP, so the traffic between your computer and Fjordrun is not encrypted unless the service itself offers TLS. Don't use public TCP on untrusted networks for sensitive data.
• Expose only the port you need, not admin or debug ports.

Each public port accepts up to 200 open connections and about 10 new connections per second (bursts of 50); excess connections are refused. Fjordrun may close a port that is used for abuse.

Turn it off

In Settings → Networking → Public TCP, choose the bin icon next to the port and confirm. Open connections close and the port can later be given to another service. Deleting the service or its environment also frees its ports.

With the API: DELETE /api/v1/services/{id}/tcp-proxy/{port}.

Billing

There is no charge for the port itself. Data your service sends to clients through public TCP is egress, billed like traffic through public domains: the first 100 GB per team and billing period are free, then €0.02 per GB. Data clients send to your service is free.

Limitations

• Plain TCP only: no UDP, and no TLS termination by Fjordrun (use the service's own TLS if it has one).
• TCP connections don't wake a service that sleeps when idle. Turn sleeping off before you enable public TCP. While a service has a public TCP port, it stays awake even if sleep when idle is on.
• Your service sees connections coming from Fjordrun's nodes, not from the client's address. Restrict access with credentials, not IP allow-lists.
• Connections can drop when Fjordrun updates the proxy or a node restarts; clients should reconnect.