QuotaGuard and Clever Cloud Integration Guide

QuotaGuard Static gives your Clever Cloud apps two static outbound IP addresses from one environment variable. Set HTTP_PROXY and HTTPS_PROXY with the Clever Tools CLI, redeploy, and every outbound request exits from one of your two static IPs across every Clever Cloud region.

Why Clever Cloud Apps Often Need Static Outbound IPs

Clever Cloud runs on its own Paris infrastructure plus partner providers (OVHcloud, Scaleway, and others), and outside Paris you have no control over the underlying egress ranges. A destination that requires a known source IP cannot rely on Clever Cloud’s shared, shifting egress. QuotaGuard gives you two static IPs assigned to your subscription that stay the same unless you ask to change them, the same pair regardless of which region or provider your app lands on.

Getting Started

After creating a QuotaGuard account, you are redirected to your dashboard, where you can find your proxy credentials and two static IP addresses.

Choose the right proxy region: Select the QuotaGuard region closest to your Clever Cloud zone to minimize latency. The region is set at sign-up. Changes after sign-up require contacting support.

Step 1: Set the Proxy with the Clever Tools CLI

Most runtimes and HTTP clients read the standard HTTP_PROXY and HTTPS_PROXY variables automatically. Set them using the proxy URL from your QuotaGuard dashboard, then redeploy, because Clever Cloud applies environment changes on the next deployment.

clever env set HTTP_PROXY "http://username:password@<your-quotaguard-proxy-host>:9293"
clever env set HTTPS_PROXY "http://username:password@<your-quotaguard-proxy-host>:9293"
clever env set NO_PROXY "localhost,127.0.0.1"
clever restart

Use the exact value of QUOTAGUARDSTATIC_URL from your dashboard.

You can also set these in the Environment variables panel of the Console. Either way, the app must redeploy or restart to pick them up.

Step 2: Route Outbound Traffic Through the Proxy

With the variables set, most clients route automatically. To be explicit per request:

Python:

import os, requests

p = os.environ["HTTPS_PROXY"]
r = requests.get("https://api.example.com/data", proxies={"http": p, "https": p})
print(r.json())

Node.js:

const { ProxyAgent, fetch } = require('undici');
const dispatcher = new ProxyAgent(process.env.HTTPS_PROXY);

const r = await fetch('https://api.example.com/data', { dispatcher });
console.log(await r.json());

PHP:

$proxy = parse_url(getenv('HTTPS_PROXY'));
$ch = curl_init('https://api.example.com/data');
curl_setopt($ch, CURLOPT_PROXY, $proxy['host'] . ':' . $proxy['port']);
curl_setopt($ch, CURLOPT_PROXYUSERPWD, $proxy['user'] . ':' . $proxy['pass']);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
echo curl_exec($ch);

For a tool that ignores the standard variables, pass it explicitly, for example curl -x "$HTTPS_PROXY" https://api.example.com/data.

Connecting to Firewalled Databases with QGTunnel

For database connections such as PostgreSQL, MySQL, or MongoDB, use QuotaGuard’s SOCKS5 proxy through QGTunnel.

Step 1: Include QGTunnel in your app

curl https://s3.amazonaws.com/quotaguard/qgtunnel-latest.tar.gz | tar xz

Commit bin/qgtunnel and vendor/nss_wrapper/ to your repository.

Step 2: Prefix your start command

CC_RUN_COMMAND overrides the default start command on most non-Docker Clever Cloud runtimes. Prefix your normal start command with bin/qgtunnel:

clever env set CC_RUN_COMMAND "bin/qgtunnel <your normal start command>"

You can only set one CC_RUN_COMMAND. To run more than one command, chain them with ; or &&, or call a shell script. CC_RUN_COMMAND has no effect on Docker; for a Docker image, set the command in your Dockerfile instead.

Step 3: Configure the tunnel in the dashboard

In your QuotaGuard dashboard, go to Setup > QGTunnel Configuration > Create a Tunnel.

Transparent mode overrides DNS so your driver connects to the original hostname while traffic exits from your static IPs. Set QUOTAGUARDSTATIC_URL as well, since QGTunnel reads it.

Testing Your App Is Using the Static IP

SSH into a running instance and check the egress IP. If you have not linked the app yet, run clever link --org <your_org_id> <your_app_id> first:

clever ssh -c "curl -x \"$HTTPS_PROXY\" https://ip.quotaguard.com"

Expected response:

{"ip":"<one of your two QuotaGuard static IPs>"}

The returned IP must match one of the two static IPs in your QuotaGuard dashboard. Run it again to see both (load-balanced).

A Note on Clever Cloud’s VPN Add-On

Clever Cloud offers a VPN add-on that provides a single fixed-IP outgoing node, where you enumerate the CIDR ranges to route. QuotaGuard differs in three ways that matter for most teams: there is no tunnel to stand up or CIDR list to maintain, you get a load-balanced pair of IPs rather than a single node, and the same two IPs work across every platform you run, not just Clever Cloud. Choose whichever fits. This page documents the QuotaGuard path.

Troubleshooting

Proxy not applied after setting the variable

Clever Cloud applies environment changes on redeploy. Run clever restart (or trigger a deployment) and retest.

407 Proxy Authentication Required

The credentials are wrong. Confirm with clever env and match them to your QuotaGuard dashboard.

Wrong IP returned

The client is not honoring the variables. Pass the proxy explicitly per request, as shown above.

Connection timeout

Confirm the app can reach external networks and that nothing blocks port 9293.

QuotaGuard Static vs QuotaGuard Shield

For most Clever Cloud apps, Static is the right product. Choose QuotaGuard Shield if your app handles regulated data or your environment requires TLS between your app and the proxy itself.

Ready to Get Started?

Get in touch or create a free trial account.

Try QuotaGuard Now

Contact Support