Running the box: Docker, Linux, the JVM
The localhost in your SSH tunnel isn't yours
My production Postgres publishes no port at all, and I still open it in DBeaver from my laptop. The one-line ssh -L everyone reaches for connects happily and then refuses every query — for a reason that's easy to miss, and eight bytes that prove when you've actually fixed it.