---
title: "Migrating Heroku Database Apps To Fly"
description: "Migrating a Heroku application to Fly requires attention to database connectivity because Heroku Postgres must be accessed over SSL from outside Heroku. The post uses the DATABASE_URL environment variable, parses it with pg-connection-string, and passes a configured connector to Massive.js, setting sslmode to require and rejectUnauthorized to false to accommodate self-signed certificates in Heroku Postgres’s certificate chain. It also shows a local-development fallback that uses a non-SSL localhost Postgres connection when DATABASE_URL is undefined. With these changes, Turboku can migrate the app and convert DATABASE_URL into a Fly secret, while the application retains its database connection and can use Fly’s region and scaling controls. Database latency still depends on proximity to Heroku’s US or European database regions, so caching within Fly regions may matter for mission-critical performance."
---

# Migrating Heroku Database Apps To Fly

[Fly.io](https://yomu.fyi/company/fly-io) · Sep 25, 2020

**Type:** Tutorial

## Summary

Migrating a Heroku application to Fly requires attention to database connectivity because Heroku Postgres must be accessed over SSL from outside Heroku. The post uses the DATABASE\_URL environment variable, parses it with pg-connection-string, and passes a configured connector to Massive.js, setting sslmode to require and rejectUnauthorized to false to accommodate self-signed certificates in Heroku Postgres’s certificate chain. It also shows a local-development fallback that uses a non-SSL localhost Postgres connection when DATABASE\_URL is undefined. With these changes, Turboku can migrate the app and convert DATABASE\_URL into a Fly secret, while the application retains its database connection and can use Fly’s region and scaling controls. Database latency still depends on proximity to Heroku’s US or European database regions, so caching within Fly regions may matter for mission-critical performance.

## Context

The migration must handle changes in how Heroku and the Postgres driver manage connections. Heroku Postgres requires SSL when accessed from outside Heroku, and its certificate chain can include a self-signed certificate.

## Approach / What changed

Read DATABASE\_URL from the environment, parse it with pg-connection-string, and configure the connector with sslmode set to require and rejectUnauthorized set to false before passing it to Massive.js. When DATABASE\_URL is undefined, use a non-SSL localhost Postgres fallback for local testing. Turboku then migrates the app and stores DATABASE\_URL as a Fly secret.

## Takeaways

- Heroku Postgres connections from outside Heroku need SSL configuration rather than an unmodified connection string.
- Setting rejectUnauthorized to false avoids certificate verification errors caused by a self-signed certificate in Heroku Postgres’s server certificate chain.
- A Fly deployment keeps the Heroku database connection, but latency is tied to the database’s US or European region; regional caching may help mission-critical workloads.

**Tags:** [Fly](https://yomu.fyi/topic/fly), [Heroku](https://yomu.fyi/topic/heroku), [JavaScript](https://yomu.fyi/topic/javascript), [Postgres](https://yomu.fyi/topic/postgres)

- Source: [Fly.io](https://fly.io/blog/migrating-heroku-database-apps-to-fly)
- Source URL: https://fly.io/blog/migrating-heroku-database-apps-to-fly
- Ingested by Yomu: 2026-09-02T12:00:55.170Z

[Read original post](https://fly.io/blog/migrating-heroku-database-apps-to-fly)