I’ve started to use the Beta of the App platform.

My service is a Spring Boot application declared through a Docker image, and it connects to a Postgres database declared through the App platform.

I’ve declared the connection parameters at service level using the following environment variables:

  • SPRINGDATASOURCEURL = jdbc:postgresql://${ontrack-db.HOSTNAME}:${ontrack-db.PORT}/${ontrack-db.DATABASE}

where ontrack-db is the name of the database component.

However, at startup, the service cannot connect to the database because of the following error:

FATAL: no pg_hba.conf entry for host "", user "ontrack-db", database "ontrack-db", SSL off

So I wonder how I can make my Postgres component in the App understand that it’s OK to accept connections from the main service in the same App.

I did not find any doc related to the App platform at https://www.digitalocean.com/docs/app-platform/how-to/manage-databases/

Thanks for any help, I’m looking forward to start hosting some apps on the App platform,
Damien Coraboeuf

These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.

Submit an Answer
2 answers

@damiencoraboeuf 👋

I believe you may need to enable the use of SSL on the DB connection you’re creating from the Spring Boot application; note the , SSL off suffix at the end of the error. This could just be a matter of appending ?sslmode=require to your connection string URL, but may involve other steps depending on the PG client you’re using. We expose a bindable variable called ${JDBC_DATABASE_URL} that may simplify your use-case, since it would contain the entire connection string, including the ?sslmode=require suffix.


Thanks for the answer.

I’m now using:


and I now get:

java.net.UnknownHostException: ontrack-db:xxxxxxx@app-380c5616-0dff-4d2b-8ae7-5cf1accc4651-do-user-269664-0.b.db.ondigitalocean.com

I think it’s because the JDBC_DATABASE_URL JDBC URL contains still the username & password and it should probably not?


I’d rather expect:


I think my workaround is to build the URL myself in the meantime, using ?sslmode=require as you’ve mentioned in your answer:


Thanks a lot,