Elephants in tunnels: how Hyperdrive connects to databases inside your VPC networks

Cloudflare describes how Hyperdrive now routes PostgreSQL traffic from Workers over Cloudflare Tunnels using WebSockets, enabled by a Rust-based generic stream abstraction that implements AsyncRead/AsyncWrite for custom Postgres protocol handling. The post explains upgrading TCP/TLS connections to WebSockets, building a compatible WebSocket stream wrapper, and enforcing Zero Trust security with Access service tokens in the WebSocket upgrade headers. It highlights internal adoption (“customer zero”) to access centralized Postgres from the global network, aiming to simplify secure, low-latency database connectivity without exposing private resources to the public Internet.