Set Up a Secure Gateway
We will guide you through the process of setting up a secure gateway, which Querier provides as a Docker image. This is an option for more securely connecting to databases and APIs.
🙋♂️ Currently, secure gateway connections support the following data sources:
- MySQL
- PostgreSQL
- REST API
- GraphQL
Configuration Method
Follow these steps to configure a set-up secure gateway on Querier:
- Click on the [Integrations] tab.
- Click on [Secure Gateway].
- Create a new secure gateway from [Create new].
- Deploy the secure gateway within your company's network using the method below.
- Complete the setup by entering the following information:
| Item | Description |
|---|---|
| Name | Enter a name for the secure gateway you're configuring. |
| Host | Enter the host of the secure gateway you're connecting to. (e.g., proxy.querier.io) |
| Port | Enter the port of the gateway you're connecting to. (e.g., 443) |
| Timeout | Specify the timeout in milliseconds. (e.g., 3000) |
| Perform SSL verification | Specify whether to perform SSL verification. It's recommended to turn this on when operating in a production environment. |
Deploying the Secure Gateway
Deployment
We recommend the following environments for hosting the secure gateway:
- Google Cloud Run
- AWS Fargate
Complete the deployment by specifying the following Docker image and environment variables:
querier/secure-gateway:1.0.1Environment Variables
| Variable Name | Description | Required |
|---|---|---|
| GW_KEY | Set the gateway key that can be copied within the product. | ✅ |
| LOG_LEVEL | Set LOG_LEVEL as needed. Set one of DEBUG, INFO, WARN, or ERROR. The default value is INFO. | ❌ |
Security update 1.0.1
Version 1.0.1 fixes certificate validation vulnerability CVE-2026-111943 affecting releases before 1.0.1. It uses Go 1.27.3 and an updated CA bundle. Both Linux amd64 and arm64 images are available.
- Update the image in your Cloud Run service, ECS task definition, or container configuration to
querier/secure-gateway:1.0.1and deploy it. Pulling the image alone does not update a running gateway. - Preserve your existing
GW_KEY, other environment variables, networking, and TLS configuration. - Verify that
https://YOUR_GATEWAY_HOST/healthreturns{"version":"1.0.1"}and test a data source connection in Querier. - Reload Querier's Secure Gateway settings. The update notice clears after the connected gateway reports a fixed version.
Older gateways return an empty health response. Querier shows the version as unknown in that case; a connection failure is shown separately. If a rollout fails, restore your previous deployment configuration while investigating, then apply the security update again.