Thank you all for your comments.
I think I got it: PostgreSQL should listen to the real, non-loopback network interface.
Just for info (local dev config, not prod):
sf@toro:/opt3/dbs/pgs/14.1-openssl/data$ grep listen_addresses postgresql.conf
listen_addresses = 'localhost,toro.strasbourg.4js.com'
sf@toro:/opt3/dbs/pgs/14.1-openssl/data$ netstat -tl -W | grep 5437
tcp 0 0 localhost:5437 0.0.0.0:* LISTEN
tcp 0 0 toro.strasbourg.4js.com:5437 0.0.0.0:* LISTEN
tcp6 0 0 localhost:5437 [::]:* LISTEN
sf@toro:/opt3/dbs/pgs/14.1-openssl/data$ netstat -tl -W --numeric-hosts | grep 5437
tcp 0 0 127.0.0.1:5437 0.0.0.0:* LISTEN
tcp 0 0 127.0.1.1:5437 0.0.0.0:* LISTEN
tcp6 0 0 ::1:5437 :::* LISTEN
sf@toro:/opt3/dbs/pgs/14.1-openssl/data$ ip route get 127.0.1.1
local 127.0.1.1 dev lo src 127.0.0.1 uid 1000
cache <local>
Seb
