Thank you all for your comments. I think I got it: PostgreSQL should listen to the real, non-loopback network interface.
Just for info (local dev config, not prod): sf@toro:/opt3/dbs/pgs/14.1-openssl/data$ grep listen_addresses postgresql.conf listen_addresses = 'localhost,toro.strasbourg.4js.com' sf@toro:/opt3/dbs/pgs/14.1-openssl/data$ netstat -tl -W | grep 5437 tcp 0 0 localhost:5437 0.0.0.0:* LISTEN tcp 0 0 toro.strasbourg.4js.com:5437 0.0.0.0:* LISTEN tcp6 0 0 localhost:5437 [::]:* LISTEN sf@toro:/opt3/dbs/pgs/14.1-openssl/data$ netstat -tl -W --numeric-hosts | grep 5437 tcp 0 0 127.0.0.1:5437 0.0.0.0:* LISTEN tcp 0 0 127.0.1.1:5437 0.0.0.0:* LISTEN tcp6 0 0 ::1:5437 :::* LISTEN sf@toro:/opt3/dbs/pgs/14.1-openssl/data$ ip route get 127.0.1.1 local 127.0.1.1 dev lo src 127.0.0.1 uid 1000 cache <local> Seb