The tunnel

The cloud never connects into a customer's network. Instead an agent inside that network opens one outbound, mutually authenticated TLS connection to a relay in your cloud, and all traffic to the customer's database goes through it. The relay exposes the organization's database inside your cloud as an address such as relay:15001, where the cloud Postgres (through postgres_fdw) and the proxy reach it.

• Enrolment uses a single-use token (lokadb token -org 1); after that the agent keeps its certificate and needs no new token.
• Certificates renew themselves and can be revoked: the relay checks live sessions against the registry every two seconds.
• The agent forwards only to its -db address, and its private key never leaves its machine. The CA key lives in a separate issuing service.
• TLS can run end to end from the cloud to the customer's database, so that the relay sees only ciphertext.
• An organization can run several agents, and there can be several relays, for availability.

The mechanics, the flags and the high-availability setup are in the tunnel in production.