Show HN: A Tailscale identity-aware gateway for Postgres and ClickHouse

Overview and Architecture

The tailscale-database-gateway is a proxy that enables passwordless access to PostgreSQL and ClickHouse databases by leveraging Tailscale identity and HashiCorp Vault dynamic credentials. It acts as an intermediary between clients and the database, authenticating based on Tailscale identity and application grants. This approach eliminates the need for hard-coded credentials, enhancing security and reducing the risk of credential exposure.

Key Features and Capabilities

The gateway supports both PostgreSQL and ClickHouse, including native TCP and HTTP protocols for ClickHouse. It can authenticate using either static credentials from a file or temporary credentials issued by Vault. This dual authentication model provides flexibility depending on the security requirements of the environment.

The project is designed to be containerized, making it easy to deploy using Docker, Kubernetes, or other OCI-compatible runtimes. It requires a Tailscale auth key, database connection details, and proper tailnet policy configuration to function correctly. For advanced use cases, it integrates with Vault to dynamically generate temporary credentials, reducing the need for long-lived database logins.

Configuration and Deployment

Configuration involves creating a JSON file that defines the database backend, upstream connection details, and credential sources. This file must be mounted into the container, along with any necessary credential files or Vault configuration. Environment variables are also used to specify runtime parameters such as the Tailscale hostname, state directory, and Vault address.

For Kubernetes deployments, the same configuration applies, with the addition of mounting secrets and ensuring proper user permissions. The gateway runs as a non-root user with UID/GID 1000:1000, and the container must have write access to the state directory and /tmp. No host port publishing is required, as all client connections are routed through Tailscale.

Security and Credential Management

The gateway ensures that database credentials are never exposed to clients. Instead, it authenticates to the upstream database on behalf of the client, using either static or dynamic credentials. For Vault-backed credentials, the Vault Proxy manages the lifecycle of temporary tokens, including renewal and expiry. This reduces the attack surface and ensures that credentials are only valid for as long as they are needed.

When using static credentials, the gateway reads from a file that contains the username and password. This file must be kept private and not committed to source control. The gateway does not create database roles or permissions; these must be configured separately by the database administrator.

Use Cases and Limitations

This project is ideal for organizations that use Tailscale for secure network access and want to eliminate the use of static database credentials. It is particularly useful in environments where temporary access is required, such as during development or testing. The integration with Vault makes it a strong candidate for organizations already using HashiCorp Vault for secret management.

However, the project is still in early stages, and the documentation and examples are limited. It requires a working Tailscale setup and proper configuration of both the database and Vault (if used). Additionally, the project does not support all database features, and some advanced configurations may require further customization.

Conclusion

The tailscale-database-gateway is a promising open-source project that addresses the need for secure, passwordless access to databases. By leveraging Tailscale identity and Vault dynamic credentials, it provides a flexible and secure solution for managing database access. While it is still in development, it has the potential to become a valuable tool for organizations looking to enhance their database security posture.

Source: Hacker News Show. Analysis based on publicly available information; no hands-on testing is claimed.