I have an issue which may or not be related to @Sam's. I've set up a Hyperdrive, but when I run loca

I have an issue which may or not be related to @Sam's. I've set up a Hyperdrive, but when I run locally, I get an error from PG that

 no pg_hba.conf entry for host "<IP>"

 no pg_hba.conf entry for host "<IP>"

, even though I'm connecting to a publicly-accessible (albeit remotely-hosted) DB. Other apps on my local machine not using CF can connect to it fine, as can a local DB client I use. The connection string is definitely correct. If I run the app with

--remote

--remote

it does connect. Anyone any idea here?

MMitya I have an issue which may or not be related to @Sam's. I've set up a Hyperdrive,...

Sam•12/14/23, 6:19 PM

It's not related to mine, the "HYPERDRIVE" environment variable is not being filled developing locally. You need to do this yourself

MityaOP•12/14/23, 6:20 PM

Not sure I follow. My TOML has:

MityaOP•12/14/23, 6:20 PM

Shouldn't that work locally? The guide suggests that's what's needed.

Sam•12/14/23, 6:22 PM

Ah yeah, I'm using another way by putting it in my .dev.vars. Don't want my connection string exposed in the wrangler.toml file. But still not related to my issue

MityaOP•12/14/23, 6:24 PM

Ahh OK, gotcha. Re: not exposing the connection string, I faced the same issue. I found that if I put my connection string in my Wrangler error'd on startup, it had to be in the TOML. So in the end I set up two TOMLs -

wrangler.toml

wrangler.toml

and and just pointed my dev script to the latter via the arg.

MityaOP•12/14/23, 6:29 PM

Anyway, good luck with your issue. Hopefully someone from CF (@kian?) can help with the above as it's proving a pain!

kian•12/14/23, 6:31 PM

I’m just a community member but I agree that it’s a bit of an odd pattern, the traditional guidance is that everything in Wrangler.toml is safe to commit to VCS & secrets are either stored on the edge or in .dev.vars

Kkian I’m just a community member but I agree that it’s a bit of an odd pattern, the t...

Sam•12/14/23, 6:31 PM

I think we're both talking about publishing to Github

MityaOP•12/14/23, 6:31 PM

Sorry I meant the PG IP error issue when I run locally not via

--remote

--remote

MityaOP•12/14/23, 6:32 PM

(Not that I want to gazump @Sam here - he was probably first in line in getting help.)

MMitya (Not that I want to gazump @Sam here - he was probably first in line in getting ...

Sam•12/14/23, 6:32 PM

It's ok haha

kian•12/14/23, 6:35 PM

The local Hyperdrive is really just talking to your localConnectionString with the TCP sockets API, it isn’t any different to if you passed it in your code directly rather than the Hyperdrive binding.

Does your pg_hba.conf dictate a specific auth method or options (like ssl)? It sounds like Hyperdrive supports a set of features that the direct connection might not.

MityaOP•12/14/23, 6:36 PM

Yeah I assumed local mode bypassed Hyperdrive completely and just connected traditionally, without Hyperdrive. As for pg_hba.conf, I'm afraid this is where my expertise ends. I don't literally have that file - I just have a Heroku-hosted DB that I can connect to publicly (i.e. there's no IP whitelist or anything like that). Non-Wrangler apps running on my machine can talk to it, but the Wrangler app throws the PG error.

kian•12/14/23, 6:37 PM

Do you have the full FATAL error from the Worker? Feel free to redact the IP/username

kian•12/14/23, 6:38 PM

If it says ssl off, Heroku requires SSL for all connections

MityaOP•12/14/23, 6:39 PM

I connect via:

This is taken verbatim from an app that connects to the DB fine.

Full error output is:

kian•12/14/23, 6:40 PM

This is node-postgres I assume

MityaOP•12/14/23, 6:40 PM

Sorry yes

kian•12/14/23, 6:43 PM

Try adding ?sslmode=require to your local conn. string

MityaOP•12/14/23, 6:44 PM

Right after the DB name? Same deal, unfortunately.

MityaOP•12/14/23, 6:46 PM

(Disappearing for dinner but will check back later. Really appreciate the help, whether it gets solved or not!)

kian•12/14/23, 6:49 PM

Does the error still say no encryption?

kian•12/14/23, 6:53 PM

I guess “no encryption” could also refer to the password. I.E scram-sha-256

MMitya Sorry yes

Matt Silverlock•12/14/23, 8:11 PM

What version of

MityaOP•12/15/23, 11:40 AM

Yes the error still says no encryption. (i.e. the

pg

pg

package) is v. ^8.10.0

MMitya Yes the error still says no encryption. `node-postgres` (i.e. the `pg` package) ...

Matt Silverlock•12/15/23, 11:42 AM

Matt Silverlock•12/15/23, 11:42 AM

Per https://developers.cloudflare.com/hyperdrive/learning/connect-to-postgres/#supported-drivers

Connect to PostgreSQL · Hyperdrive

Hyperdrive supports PostgreSQL and PostgreSQL-compatible databases, popular drivers and Object Relational Mapper (ORM) libraries that use those …

MityaOP•12/15/23, 11:57 AM

Good spot, and have updated PG, but still the same error

MityaOP•12/15/23, 11:58 AM

MMitya Click to see attachment

Matt Silverlock•12/15/23, 12:39 PM

The error you're getting is on the Heroku side - e.g. https://stackoverflow.com/questions/60048669/heroku-postgres-psql-fatal-no-pg-hba-conf-entry-for-host

Stack Overflow

Heroku Postgres: "psql: FATAL: no pg_hba.conf entry for host"

There are a number of Heroku CLI Postgres commands that all return the same error. For example:

$ heroku pg:bloat
psql: FATAL: no pg_hba.conf entry for host "...", user "...", database "...", SSL...

Matt Silverlock•12/15/23, 12:39 PM

is the Postgres config file; Hyperdrive is attempting to connect and getting that back.

Matt Silverlock•12/15/23, 12:40 PM

bun•12/15/23, 12:51 PM

trying to restrict access to my database to CF ips only but getting an error when trying to setup hyperdrive

bun•12/15/23, 12:52 PM

Bbun ```json "errors": [ { "code": 2011, "message": "Network connecti...

kian•12/15/23, 12:53 PM

Hyperdrive doesn’t use the public CF IPs.

bun•12/15/23, 12:54 PM

bun•12/15/23, 12:54 PM

so no good way to block non CF access via firewall rn?

kian•12/15/23, 12:55 PM

Correct, nothing yet

Kkian Correct, nothing yet

Hello, I’m Allie!•12/15/23, 1:16 PM

Wouldn't an ASN-level block work?

HHello, I’m Allie!Wouldn't an ASN-level block work?

Matt Silverlock•12/15/23, 1:31 PM

No, and we generally don't recommend that. An IP (or AS) filter doesn't stop anyone else from creating a Hyperdrive configuration and connecting to your origin database.

Matt Silverlock•12/15/23, 1:32 PM

(An AS level filter will also not work here, so please don't try it)

Sam•12/21/23, 10:42 AM

Within wrangler.toml, localConnectionString is now required. But is there any way to mask the value of this string when uploading to Github? I hate that it's required now, since we can't protect Postgres accounts by IP restrictions.

SSam Within wrangler.toml, localConnectionString is now required. But is there any wa...

Matt Silverlock•12/21/23, 11:46 AM

It should not be required. It’s only used for local testing. You can leave it empty. My Hyperdrive test project does not set it.

MMatt Silverlock It should not be _required_. It’s only used for local testing. You can leave it ...

Sam•12/21/23, 11:48 AM

I can’t start my project if I don’t give the wrangler file a local connection string. And if I keep the string empty, it also doesn’t start

SSam I can’t start my project if I don’t give the wrangler file a local connection st...

Matt Silverlock•12/21/23, 11:49 AM

That’s local — with

wrangler dev

wrangler dev

MMatt Silverlock That’s local — with `wrangler dev`.

Sam•12/21/23, 11:51 AM

Yes, but it should not be required. I want to put my connection string in .dev.vars. This wont show up in Github.

sam•12/23/23, 2:07 AM

hello hyperdrive friends

sam•12/23/23, 2:07 AM

i was hoping to hang out until mysql is supported, we're excited

AngusMa•12/23/23, 1:45 PM

The hyperdrive page shows nothing in Traditional Chinese, but it works in English.

Colin•12/29/23, 7:32 PM

we're seeing what we believe to be inconsistent caching in Hyperdrive

when repeatedly sending a relatively simple SQL query (looks just like ) with a large result ( is a couple hundred KB in size), Hyperdrive sometimes responds correctly (with one row) and sometimes responds incorrectly (with no rows)

It also seems to go in runs - we'll get correct responses for a minute, then incorrect responses for a minute, and so on. I've only ever been able to reproduce this when going through Hyperdrive (with a minute TTL cache), never when connecting directly to the DB

Unfortunately we rely pretty heavily on Hyperdrive caching to not overload the origin DB so disabling cache isn't an option here