{
  "slug": "railway-connect-tunnels-to-private-databases-over-ssh-578afc570fd3",
  "title": "railway connect tunnels to private databases over SSH",
  "tools": [
    "railway"
  ],
  "tags": [
    "agent"
  ],
  "introduced_at": "2026-06-11T18:24:59.000Z",
  "announced_at": "2026-06-11T18:24:59.000Z",
  "effective_at": null,
  "date_basis": "source-publication",
  "status": "unknown",
  "how": {
    "incantation": "If the database service has no public proxy URL, run `railway connect <db>` to connect through an SSH tunnel. Use `--ssh` to force SSH, `--no-ssh` to require the public proxy, or `-P/--port <PORT>` to choose the local port.",
    "examples": [
      "railway connect <db>",
      "railway connect <db> --ssh",
      "railway connect <db> --no-ssh -P <PORT>"
    ],
    "gotchas": [
      "Version: v5.11.0",
      "<db> / [SERVICE_NAME]: Database service name; if omitted, prompts for a service when multiple exist.",
      "--ssh: Use SSH instead of a public TCP proxy; automatic when no public proxy URL is available.",
      "--no-ssh: Force the public TCP proxy path; conflicts with `--ssh`.",
      "-P, --port <PORT>: Local port for the SSH tunnel; defaults to an ephemeral port.",
      "Prerequisite: Install the appropriate local database client: `psql` for PostgreSQL, `mysql` for MySQL, `redis-cli` for Redis, or `mongosh` for MongoDB. The client is not required when using `--tunnel-only`.",
      "Prerequisite: SSH connections require an SSH key registered with Railway; the CLI prompts to register a local key the first time you run `railway ssh`.",
      "Supported databases: Postgres, MySQL, Redis, and MongoDB.",
      "The local port is ephemeral by default unless pinned with `-P/--port`.",
      "The SSH tunnel lives as long as the client."
    ]
  },
  "why_it_matters": "Connect to a private Postgres, MySQL, Redis, or MongoDB service that has no public port.",
  "before": "Before the change, `railway connect` required a public TCP proxy and errored for a private-only database service.",
  "sources": [
    "https://github.com/railwayapp/cli/releases/tag/v5.11.0",
    "https://github.com/railwayapp/cli/pull/955",
    "https://docs.railway.com/cli/connect",
    "https://docs.railway.com/cli/ssh"
  ],
  "rank": 0.97032,
  "judge": {
    "publish": true,
    "judge_model": "codex-cli/gpt-6-luna+typesafe/jev-1.13.0",
    "prompt_version": "extract-v7+enrich-v2+judge-v2x3+jev-publish-v1"
  },
  "review_state": "approved",
  "provenance": {
    "run_id": "wave1b-20261016",
    "verdict_id": "wave1b-20261016:wave1b-20261016-f4cb5e486973ce7b-0:gate",
    "evidence_hash": "af1b16b2a653dda76ed1e9cc021b3381b3f75e8447bc71f79ea8aca56cccab40"
  },
  "review": {
    "draft_hash": "ceb2aabb1a2353fb12b5dd9126073725c103660174e3fc2a84d2f22976ae7128",
    "reviewer": "publication-gate",
    "reviewed_at": "2026-10-07T00:00:00.000Z",
    "decision": "wave1b-20261016:gate",
    "reason": "3 of 3 judge runs approved with p_yes >= 0.9 (mean 0.97 >= 0.9; 2 needed) and Jev gave 0.80 (>= 0.6 needed)."
  }
}