Question: are there any sort of egress IP ranges we can add to our firewall for hyperdrive->origin,

Question: are there any sort of egress IP ranges we can add to our firewall for hyperdrive->origin, or should we wait for CF tunnel support if we’re worried about public access?

CColin Question: are there any sort of egress IP ranges we can add to our firewall for ...

Matt Silverlock•9/28/23, 2:20 PM

The latter for now. We generally don't recommend IP ACLs like this, and would still allow any other customer to connect to your database (create a Worker, create a Hyperdrive to your DB, or a TCP socket). Only makes sense if we give each user a dedicated IP address, which isn't scalable.

ColinOP•9/28/23, 2:25 PM

Right, that makes sense - super excited for CF Tunnel integration here then

ColinOP•9/28/23, 2:26 PM

would also love to see a more general version of hyperdrive (or similar tech) for accessing private resources (IE so we can communicate with services back on our AWS VPC from a Worker via a secure tunnel)

CColin would also love to see a more general version of hyperdrive (or similar tech) fo...

Matt Silverlock•9/28/23, 2:57 PM

I think that's fundamentally just Workers + Magic WAN / Tunnels. You can connect to tunneled resources via a Tunnel from a Worker today, but we want to make it easier to set that up.

MMatt Silverlock I think that's fundamentally just Workers + Magic WAN / Tunnels. You _can_ conne...

ColinOP•9/28/23, 3:03 PM

You can connect to tunneled resources via a Tunnel from a Worker today

ah, I was unaware this was possible currently. Is it just the standard "things in your CF account can access the $uuid.cfargotunnel.com$uuid.cfargotunnel.com bit?

CColin > You can connect to tunneled resources via a Tunnel from a Worker today ah, I w...

Matt Silverlock•9/28/23, 3:10 PM

Yep. You can put Access in front and use a Service Token to auth as well.

MMatt Silverlock Yep. You can put Access in front and use a Service Token to auth as well.

ColinOP•9/28/23, 3:11 PM

Gotcha - I think I interpreted Hyperdrive's role as private connectivity + connection pooling, but makes sense the private connectivity is CF Tunnel. super excited again for the CF Tunnel integration!

MMatt Silverlock Yep. You can put Access in front and use a Service Token to auth as well.

Isaac McFadyen•9/28/23, 3:18 PM

Does this extend to TCP from Workers? I.e. via the Socket API or similar?

CColin Gotcha - I think I interpreted Hyperdrive's role as private connectivity + conne...

Matt Silverlock•9/28/23, 3:26 PM

To be clear, Hyperdrive will build a lot of this in — but at some point you need to give us a way to get to that private resource, which has to be Tunnel or Magic WAN (IPSec, GRE, etc)

IIsaac McFadyen Does this extend to TCP from Workers? I.e. via the Socket API or similar?

Matt Silverlock•9/28/23, 3:26 PM

Not yet.

Sameer Ali•9/28/23, 4:13 PM

I have been waiting for this for a long time. Excellent Job

kian•9/28/23, 6:50 PM

Does your connection string start with postgres://postgres://?

kian•9/28/23, 6:51 PM

(or postgresql://)postgresql://)

kian•9/28/23, 7:06 PM

If you do new URL(yourConnectionString).protocolnew URL(yourConnectionString).protocol in Node, what do you get?

kian•9/28/23, 7:15 PM

The dashboard one is correct. https://github.com/cloudflare/cloudflare-docs/pull/10980/files

kian•9/28/23, 7:46 PM

The note about 3.8.0 doesn't look right either, Hyperdrive was added in 3.10.0.

kian•9/28/23, 7:46 PM

Might be another one to cover in your PR? @alex.robinson

Unsmart•9/28/23, 8:55 PM

I mean always being warm would obviously be super nice but I think what matters more at least on the hobby project side is not paying for idle usage. For an actual business use though I do think even paying to keep connection always warm to reduce times is ideal

Sameer Ali•9/28/23, 9:53 PM

What if we can configure the idle timeout?