Issue

Envoy gateway is unable to connect to internal PostgREST and Gotrue Auth services via Railway's private network, despite correct variable resolution and DNS configuration.

Diagnostic Summary

All variables resolve correctly to .railway.internal hostnames, but TCP connections from Envoy to other internal services timeout consistently.

Symptoms

• Envoy service: Online, receiving requests correctly

  • GET / returns 401 (Studio basic auth, working)
  • GET /rest/v1/ returns 403 (PostgREST RBAC, working)
  • GET /auth/v1/health returns 503 upstream timeout (BROKEN)
  • GET /rest/v1/comercios returns 503 upstream timeout (BROKEN)

• PostgREST service: Online, 1/1 running

• Gotrue Auth service: Online, 1/1 running

Root Cause Evidence

1. Variables resolve correctly to .railway.internal:

   REST_HOST=postgrest.railway.internal

   AUTH_HOST=gotrue-auth.railway.internal

2. Envoy configuration is correct with proper cluster addresses

3. DNS resolver configured: nameserver fd12::10

4. Problem is network connectivity, not configuration:

   • Envoy receives requests (401/403 responses work)
   • Envoy resolves hostnames correctly
   • TCP connections to other services timeout
   • Affects ALL upstream services
   • Error: "upstream connect error... reset reason: connection timeout"

Details

• Project: giving-empathy
• Environment: production
• Region: sfo

Conclusion

This appears to be a private network connectivity issue at the Railway infrastructure level. All services are properly configured and hostnames resolve correctly, but TCP connections timeout.