3 ms·
Then you lose some security though, because I think Heroku uses large IPs ranges [1]. There seems to be no way to allow database access from a private IP addres
by conradk 8y ago
Then you lose some security though, because I think Heroku uses large IPs ranges [1]. There seems to be no way to allow database access from a private IP address, other than using expensive proxying addons. That means you probably have to open up your database to 0.0.0.0/0, which is not good at all.
[1] https://stackoverflow.com/questions/15512360/get-a-finite-list-of-ip-addresses-for-my-heroku-app#15520074 https://stackoverflow.com/questions/15512360/get-a-finite-li...
- koolba 8y agoNothing stops someone from spinning up a Heroku bash terminal and trying to access your internal DB either so it’s not markedly worse than pure Heroku.
- edoceo 8y agoYou can get better firewall control than just open/shut
- conradk 8y agoWould you mind sharing what you have in mind please? I'm genuinely interested in how that would work.
- edoceo 8y agoSure, I have a PG database on the internet. It's firewall allows only traffic from my whitelist IPs. Additionally these PG servers require SSL[0] from only my CA so even if firewall is open, no access. [0] https://www.postgresql.org/docs/current/static/ssl-tcp.html https://www.postgresql.org/docs/current/static/ssl-tcp.html
- hamandcheese 8y agoIs Heroku Postgres locked down by default? Maybe I’m misremembering, but I’m pretty sure I’ve used the Heroku database url on my local machine before.
- jacobgreenleaf 8y agoRedis has authentication.
- MapleWalnut 8y agoHeroku has "private spaces" which will give you a fixed set of outbound IPs, AWS VPC peering, and a firewall via Trusted IP Ranges. Heroku is surprisingly nice as an enterprise customer. https://devcenter.heroku.com/articles/private-spaces#stable-outbound-ip-addresses https://devcenter.heroku.com/articles/private-spaces#stable-...