diff --git a/lib/fed/codecs/netconncodec/codec.go b/lib/fed/codecs/netconncodec/codec.go
index 93d343c4a2f9c2eacf42acddfad6eca8d9213900..b1887bf388c4a777da81fc1dcf6561d386383819 100644
--- a/lib/fed/codecs/netconncodec/codec.go
+++ b/lib/fed/codecs/netconncodec/codec.go
@@ -48,6 +48,17 @@ func (c *Codec) WritePacket(packet fed.Packet) error {
 
 	return packet.WriteTo(&c.encoder)
 }
+func (c *Codec) WriteByte(b byte) error {
+	return c.encoder.WriteByte(b)
+}
+
+func (c *Codec) ReadByte() (byte, error) {
+	if err := c.Flush(); err != nil {
+		return 0, err
+	}
+
+	return c.decoder.ReadByte()
+}
 
 func (c *Codec) Flush() error {
 	return c.encoder.Flush()
diff --git a/lib/fed/conn.go b/lib/fed/conn.go
index e1b804c11ccf4691c23fe413dddedc953d27e6e7..848a0bb91acd037656243973d0af622ec9dee770 100644
--- a/lib/fed/conn.go
+++ b/lib/fed/conn.go
@@ -2,7 +2,6 @@ package fed
 
 import (
 	"crypto/tls"
-	"errors"
 
 	"gfx.cafe/gfx/pggat/lib/util/decorator"
 	"gfx.cafe/gfx/pggat/lib/util/strutil"
@@ -155,47 +154,17 @@ func (T *Conn) WritePacket(packet Packet) error {
 }
 
 func (T *Conn) WriteByte(b byte) error {
-	return T.encoder.WriteByte(b)
+	return T.codec.WriteByte(b)
 }
 
 func (T *Conn) ReadByte() (byte, error) {
-	if err := T.Flush(); err != nil {
-		return 0, err
-	}
-
-	return T.decoder.ReadByte()
+	return T.codec.ReadByte()
 }
 
 func (T *Conn) EnableSSL(config *tls.Config, isClient bool) error {
-	if T.SSL {
-		return errors.New("SSL is already enabled")
-	}
-	T.SSL = true
-
-	// Flush buffers
-	if err := T.Flush(); err != nil {
-		return err
-	}
-	if T.decoder.Buffered() > 0 {
-		return errors.New("expected empty read buffer")
-	}
-
-	var sslConn *tls.Conn
-	if isClient {
-		sslConn = tls.Client(T.NetConn, config)
-	} else {
-		sslConn = tls.Server(T.NetConn, config)
-	}
-	T.encoder.Reset(sslConn)
-	T.decoder.Reset(sslConn)
-	T.NetConn = sslConn
-	return sslConn.Handshake()
+	return T.EnableSSL(config, isClient)
 }
 
 func (T *Conn) Close() error {
-	if err := T.encoder.Flush(); err != nil {
-		return err
-	}
-
-	return T.NetConn.Close()
+	return T.codec.Close()
 }
diff --git a/lib/fed/interface.go b/lib/fed/interface.go
index 00c4f6609c3cfac165e82c88cbb8327296fb016f..636d62a13fd321278543fcd52d62e95e580b0886 100644
--- a/lib/fed/interface.go
+++ b/lib/fed/interface.go
@@ -8,6 +8,9 @@ import (
 type PacketCodec interface {
 	ReadPacket(typed bool) (Packet, error)
 	WritePacket(packet Packet) error
+	WriteByte(b byte) error
+	ReadByte() (byte, error)
+
 	LocalAddr() net.Addr
 	Flush() error
 	Close() error
diff --git a/out b/out
new file mode 100644
index 0000000000000000000000000000000000000000..b1ca9b575d25fc589fab8036f6d3f56abebaf618
--- /dev/null
+++ b/out
@@ -0,0 +1,75 @@
+{
+  "apps": {
+    "pggat": {
+      "stat_log_period": 60000000000,
+      "servers": [
+        {
+          "listen": [
+            {
+              "address": ":5432",
+              "ssl": {
+                "provider": "self_signed"
+              },
+              "max_connections": 1000
+            }
+          ],
+          "routes": [
+            {
+              "match": {
+                "matcher": "user",
+                "user": "*_ro"
+              },
+              "handle": {
+                "handler": "rewrite_parameter",
+                "key": "hybrid.mode",
+                "value": "ro"
+              }
+            },
+            {
+              "match": {
+                "matcher": "user",
+                "user": "*_ro"
+              },
+              "handle": {
+                "handler": "rewrite_user",
+                "mode": "strip_suffix",
+                "user": "_ro"
+              }
+            },
+            {
+              "handle": {
+                "discoverer": {
+                  "api_key": "some_env_var",
+                  "discoverer": "digitalocean"
+                },
+                "handler": "discovery",
+                "pool": {
+                  "client_acquire_timeout": 60000000000,
+                  "pool": "hybrid",
+                  "server_idle_timeout": 300000000000,
+                  "server_reconnect_initial_time": 5000000000,
+                  "server_reconnect_max_time": 60000000000,
+                  "tracked_parameters": [
+                    "client_encoding",
+                    "datestyle",
+                    "timezone",
+                    "standard_conforming_strings",
+                    "application_name",
+                    "intervalstyle",
+                    "search_path"
+                  ]
+                },
+                "reconcile_period": 300000000000,
+                "server_max_connections": 50,
+                "server_ssl": {
+                  "provider": "insecure_skip_verify"
+                },
+                "server_ssl_mode": "prefer"
+              }
+            }
+          ]
+        }
+      ]
+    }
+  }
+}