What combinations of services support db_service?

[MarcClusterman]

I'm playing around with getting db_service working to access a PostgreSQL/Aurora database. The docs seem clear enough; I'm trying to add the db_service to the same Teleport node that's already running the proxy service (but not the auth_service, that's on a dedicated admin machine). Here's a simplified version of the config:

db_service:
  enabled: yes
  databases:
  - name: testdb
    description: mytestdb
    protocol: postgres
    uri: abc.amazonaws.com:6543
    aws:
      region: us-west-2
    static_labels:
      env: dev

proxy_service:
  enabled: yes
  listen_addr: 0.0.0.0:3023
  web_listen_addr: 0.0.0.0:3080
  mysql_listen_addr: 0.0.0.0:3036
  public_addr: abc.company.com:443
  ssh_public_addr: abc.company.com:3023

So far I have been unable to get this to work. I get the following error:

Mar 25 15:23:45 ip-172-20-31-190 /usr/local/bin/teleport[8256]: WARN [PROC:1] Teleport process has exited with error: failed to find reverse tunnel address, if running in a single-process mode, make sure auth_service, proxy_service, and db_service are all enabled service:db.init service/supervisor.go:251

Mar 25 15:23:45 ip-172-20-31-190 /usr/local/bin/teleport[8256]: ERRO [PROC:1] Critical service db.init has exited with error failed to find reverse tunnel address, if running in a single-process mode, make sure auth_service, proxy_service, and db_service are all enabled, aborting. service/signals.go:144

I guess my question is, is this combination of Teleport services (db and proxy but not auth) expected to work? A quick look at the code seems to suggest the other places this tunnel concept is used is with k8s, and we already are running that and it seems to work.

[MarcClusterman]

Whoops, looks like I was just missing the tunnel_listen_addr directive, somehow I missed that the tunnel used for db nodes to talk the proxy is the same as the tunnel used for trusted cluster peering.