/usr/bin/proxy

{"timestamp":"2026-11-10T13:52:11.927752Z","level":"INFO","message":"not initializing Sentry, no SENTRY_DSN given","spans":{},"process_id":2,"thread_id":2,"thread_name":"main","target":"utils::sentry_init","src":"libs/utils/src/sentry_init.rs:14"}
{"timestamp":"2026-11-10T13:52:11.927851Z","level":"INFO","message":"Version: git:5340423416b46c85841904f42c93be9af145c643-modified","spans":{},"process_id":2,"thread_id":2,"thread_name":"main","target":"proxy::binary::proxy","src":"proxy/src/binary/proxy.rs:342"}
{"timestamp":"2026-11-10T13:52:11.927864Z","level":"INFO","message":"Build_tag: build_tag:","spans":{},"process_id":2,"thread_id":2,"thread_name":"main","target":"proxy::binary::proxy","src":"proxy/src/binary/proxy.rs:343"}
Neon proxy/router

Usage: proxy [OPTIONS]

Options:
      --region <REGION>
          Name of the region this proxy is deployed in

          [default: ]

  -p, --proxy <PROXY>
          listen for incoming client connections on ip:port

          [default: 127.0.0.1:4432]

      --auth-backend <AUTH_BACKEND>
          [default: console-redirect]
          [possible values: control-plane, console-redirect]

  -m, --mgmt <MGMT>
          listen for management callback connection on ip:port

          [default: 127.0.0.1:7000]

      --http <HTTP>
          listen for incoming http connections (metrics, etc) on ip:port

          [default: 127.0.0.1:7001]

      --wss <WSS>
          listen for incoming wss connections on ip:port

  -u, --uri <URI>
          redirect unauthenticated users to the given uri in case of console redirect auth

          [default: http://localhost:3000/psql_session/]

  -a, --auth-endpoint <AUTH_ENDPOINT>
          cloud API endpoint for authenticating users

          [default: http://localhost:3000/authenticate_proxy_request/]

      --control-plane-token <JWT>
          JWT used to connect to control plane

          [env: NEON_PROXY_TO_CONTROLPLANE_TOKEN=]
          [default: ]

      --is-auth-broker <IS_AUTH_BROKER>
          if this is not local proxy, this toggles whether we accept jwt or passwords for http

          [default: false]
          [possible values: true, false]

  -k, --tls-key <TLS_KEY>
          path to TLS key for client postgres connections

          tls-key and tls-cert are for backwards compatibility, we can put all certs in one dir

  -c, --tls-cert <TLS_CERT>
          path to TLS cert for client postgres connections

          tls-key and tls-cert are for backwards compatibility, we can put all certs in one dir

      --allow-tls-keylogfile
          Allow writing TLS session keys to the given file pointed to by the environment variable `SSLKEYLOGFILE`

      --certs-dir <CERTS_DIR>
          path to directory with TLS certificates for client postgres connections

      --handshake-timeout <HANDSHAKE_TIMEOUT>
          timeout for the TLS handshake

          [default: 15s]

      --wake-compute-cache <WAKE_COMPUTE_CACHE>
          cache for `wake_compute` api method (use `size=0` to disable)

          [default: size=4000,ttl=4m]

      --wake-compute-lock <WAKE_COMPUTE_LOCK>
          lock for `wake_compute` api method. example: "shards=32,permits=4,epoch=10m,timeout=1s". (use `permits=0` to disable)

          [default: permits=0]

      --connect-compute-lock <CONNECT_COMPUTE_LOCK>
          lock for `connect_compute` api method. example: "shards=32,permits=4,epoch=10m,timeout=1s". (use `permits=0` to disable)

          [default: shards=64,permits=100,epoch=10m,timeout=10ms]

      --sql-over-http-timeout <SQL_OVER_HTTP_TIMEOUT>
          timeout for http connection requests

          [default: 15s]

      --sql-over-http-pool-opt-in <SQL_OVER_HTTP_POOL_OPT_IN>
          Whether the SQL over http pool is opt-in

          [default: true]
          [possible values: true, false]

      --sql-over-http-pool-max-conns-per-endpoint <SQL_OVER_HTTP_POOL_MAX_CONNS_PER_ENDPOINT>
          How many connections to pool for each endpoint. Excess connections are discarded

          [default: 20]

      --sql-over-http-pool-max-total-conns <SQL_OVER_HTTP_POOL_MAX_TOTAL_CONNS>
          How many connections to pool for each endpoint. Excess connections are discarded

          [default: 20000]

      --sql-over-http-idle-timeout <SQL_OVER_HTTP_IDLE_TIMEOUT>
          How long pooled connections should remain idle for before closing

          [default: 5m]

      --sql-over-http-pool-gc-epoch <SQL_OVER_HTTP_POOL_GC_EPOCH>
          Duration each shard will wait on average before a GC sweep. A longer time will causes sweeps to take longer but will interfere less frequently

          [default: 10m]

      --sql-over-http-pool-shards <SQL_OVER_HTTP_POOL_SHARDS>
          How many shards should the global pool have. Must be a power of two. More shards will introduce less contention for pool operations, but can increase memory used by the pool

          [default: 128]

      --sql-over-http-client-conn-threshold <SQL_OVER_HTTP_CLIENT_CONN_THRESHOLD>
          [default: 10000]

      --sql-over-http-cancel-set-shards <SQL_OVER_HTTP_CANCEL_SET_SHARDS>
          [default: 64]

      --sql-over-http-max-request-size-bytes <SQL_OVER_HTTP_MAX_REQUEST_SIZE_BYTES>
          [default: 10485760]

      --sql-over-http-max-response-size-bytes <SQL_OVER_HTTP_MAX_RESPONSE_SIZE_BYTES>
          [default: 10485760]

      --scram-protocol-timeout <SCRAM_PROTOCOL_TIMEOUT>
          timeout for scram authentication protocol

          [default: 15s]

      --scram-thread-pool-size <SCRAM_THREAD_POOL_SIZE>
          size of the threadpool for password hashing

          [default: 4]

      --endpoint-rps-limit <ENDPOINT_RPS_LIMIT>
          Endpoint rate limiter max number of requests per second.

          Provided in the form `<Requests Per Second>@<Bucket Duration Size>`. Can be given multiple times for different bucket sizes.

          [default: 500@1s 300@1m 200@10m]

      --wake-compute-limit <WAKE_COMPUTE_LIMIT>
          Wake compute rate limiter max number of requests per second

          [default: 300@1s 200@1m 100@10m]

      --cancellation-ch-size <CANCELLATION_CH_SIZE>
          Cancellation channel size (max queue size for redis kv client)

          [default: 1024]

      --cancellation-batch-size <CANCELLATION_BATCH_SIZE>
          Cancellation ops batch size for redis

          [default: 8]

      --redis-plain <REDIS_PLAIN>
          redis url for plain authentication

      --redis-auth-type <REDIS_AUTH_TYPE>
          what from the available authentications type to use for redis. Supported are "irsa" and "plain"

          [default: irsa]

      --redis-host <REDIS_HOST>
          redis host for irsa authentication

      --redis-port <REDIS_PORT>
          redis port for irsa authentication

      --redis-cluster-name <REDIS_CLUSTER_NAME>
          redis cluster name for irsa authentication

      --redis-user-id <REDIS_USER_ID>
          redis user_id for irsa authentication

      --aws-region <AWS_REGION>
          aws region for irsa authentication

          [default: ]

      --project-info-cache <PROJECT_INFO_CACHE>
          cache for `project_info` (use `size=0` to disable)

          [default: size=10000,ttl=4m,max_roles=10,gc_interval=60m]

      --endpoint-cache-config <ENDPOINT_CACHE_CONFIG>
          cache for all valid endpoints

          [default: ]

      --parquet-upload-remote-storage <PARQUET_UPLOAD_REMOTE_STORAGE>
          Storage location to upload the parquet files to. Encoded as toml (same format as pageservers), eg `{bucket_name='the-bucket',bucket_region='us-east-1',prefix_in_bucket='proxy',endpoint='http://minio:9000'}`

      --parquet-upload-disconnect-events-remote-storage <PARQUET_UPLOAD_DISCONNECT_EVENTS_REMOTE_STORAGE>


      --parquet-upload-row-group-size <PARQUET_UPLOAD_ROW_GROUP_SIZE>
          How many rows to include in a row group

          [default: 8192]

      --parquet-upload-page-size <PARQUET_UPLOAD_PAGE_SIZE>
          How large each column page should be in bytes

          [default: 1048576]

      --parquet-upload-size <PARQUET_UPLOAD_SIZE>
          How large the total parquet file should be in bytes

          [default: 100000000]

      --parquet-upload-maximum-duration <PARQUET_UPLOAD_MAXIMUM_DURATION>
          How long to wait before forcing a file upload

          [default: 20m]

      --parquet-upload-compression <PARQUET_UPLOAD_COMPRESSION>
          What level of compression to use

          [default: UNCOMPRESSED]

      --metric-collection-endpoint <METRIC_COLLECTION_ENDPOINT>
          http endpoint to receive periodic metric updates

      --metric-collection-interval <METRIC_COLLECTION_INTERVAL>
          how often metrics should be sent to a collection endpoint

      --metric-backup-collection-interval <METRIC_BACKUP_COLLECTION_INTERVAL>
          interval for backup metric collection

          [default: 10m]

      --metric-backup-collection-remote-storage <METRIC_BACKUP_COLLECTION_REMOTE_STORAGE>
          remote storage configuration for backup metric collection Encoded as toml (same format as pageservers), eg `{bucket_name='the-bucket',bucket_region='us-east-1',prefix_in_bucket='proxy',endpoint='http://minio:9000'}`

      --metric-backup-collection-chunk-size <METRIC_BACKUP_COLLECTION_CHUNK_SIZE>
          chunk size for backup metric collection Size of each event is no more than 400 bytes, so 2**22 is about 200MB before the compression

          [default: 4194304]

      --connect-to-compute-retry <CONNECT_TO_COMPUTE_RETRY>
          Whether to retry the connection to the compute node

          [default: num_retries=5,base_retry_wait_duration=200ms,retry_wait_exponent_base=2]

      --wake-compute-retry <WAKE_COMPUTE_RETRY>
          Whether to retry the wake_compute request

          [default: num_retries=8,base_retry_wait_duration=100ms,retry_wait_exponent_base=1.6]

      --is-private-access-proxy <IS_PRIVATE_ACCESS_PROXY>
          Configure if this is a private access proxy for the POC: In that case the proxy will ignore the IP allowlist

          [default: false]
          [possible values: true, false]

      --proxy-protocol-v2 <PROXY_PROTOCOL_V2>
          Configure whether all incoming requests have a Proxy Protocol V2 packet

          [default: rejected]

          Possible values:
          - required: Connection will error if PROXY protocol v2 header is missing
          - rejected: Connection will error if PROXY protocol v2 header is provided

      --webauth-confirmation-timeout <WEBAUTH_CONFIRMATION_TIMEOUT>
          Time the proxy waits for the webauth session to be confirmed by the control plane

          [default: 2m]

      --sni-router-listen <sni-router-listen>
          listen for incoming client connections on ip:port

          [default: 127.0.0.1:4432]

      --sni-router-listen-tls <sni-router-listen-tls>
          listen for incoming client connections on ip:port, requiring TLS to compute

          [default: 127.0.0.1:4433]

      --sni-router-tls-key <sni-router-tls-key>
          path to TLS key for client postgres connections

      --sni-router-tls-cert <sni-router-tls-cert>
          path to TLS cert for client postgres connections

      --sni-router-destination <sni-router-destination>
          append this domain zone to the SNI hostname to get the destination address

  -h, --help
          Print help (see a summary with '-h')

  -V, --version
          Print version