it would be really nice to see what these errors are somehow

Mmoody 💭it would be really nice to see what these errors are somehow

AJR•12/13/24, 4:59 PM

What's getting fed back to your postgres client? Is there at least useful information there?

We have a track of work for improving error reporting in our dashboard. It's definitely something that needs more polish. Just a matter of balancing priorities.

dave•12/13/24, 5:09 PM

For Google Cloud SQL, has anyone here gotten IAM based auth working instead with a Worker?

dave•12/13/24, 5:11 PM

ah, seems like I can.. https://cloud.google.com/sql/docs/postgres/iam-logins?authuser=1#logging-in-as-a-user

dave•12/13/24, 5:11 PM

question though, how do I tell Hyperdrive that the password is gonna expire after x amount of hours?

dave•12/13/24, 5:26 PM

https://developers.cloudflare.com/workers/databases/connecting-to-databases/#_top:~:text=For%20services%20that%20require%20mTLS%20authentication%2C%20use%20mTLS%20certificates%20to%20present%20a%20client%20certificate.

Does this mean I can connect via mTLS?

Cloudflare Docs

Connect to databases · Cloudflare Workers docs

Learn about the different kinds of database integrations Cloudflare supports.

AAJR What's getting fed back to your postgres client? Is there at least useful inform...

moody 💭OP•12/13/24, 5:35 PM

hard to tell, i enabled the new cloudflare logging that will hopefully help

moody 💭OP•12/13/24, 5:37 PM

ah yeah there are many 'connection terminated unexpectedly' errors in the worker log

moody 💭OP•12/13/24, 5:37 PM

dave•12/13/24, 5:46 PM

✘ [ERROR] PostgresError: pg_hba.conf rejects connection for host "1.2.3.4", user "demo", database "eh", no encryption

✘ [ERROR] PostgresError: pg_hba.conf rejects connection for host "1.2.3.4", user "demo", database "eh", no encryption

dave•12/13/24, 5:46 PM

hmm

dave•12/13/24, 5:48 PM

export WRANGLER_HYPERDRIVE_LOCAL_CONNECTION_STRING_HYPERDRIVE="postgres://REMOVED:REMOVED@1.2.3.4:5432/eh?sslmode=require"

export WRANGLER_HYPERDRIVE_LOCAL_CONNECTION_STRING_HYPERDRIVE="postgres://REMOVED:REMOVED@1.2.3.4:5432/eh?sslmode=require"

dave•12/13/24, 5:48 PM

aren't I already doing it?

Ddave ```sh export WRANGLER_HYPERDRIVE_LOCAL_CONNECTION_STRING_HYPERDRIVE="postgres://...

AJR•12/13/24, 5:51 PM

We currently cannot support SSL handshake from local dev. It's on our roadmap, but a recent attempt to add that support uncovered some pretty serious complications we need to work through.

AAJR We currently cannot support SSL handshake from local dev. It's on our roadmap, ...

dave•12/13/24, 5:53 PM

yikes, that's uh, not great.

So I'm going to have to do my database stuff unencrypted over the internet for a remote database?

dave•12/13/24, 5:56 PM

@AJR is there a github ticket I can follow for it?

Ddave yikes, that's uh, not great. 😅 So I'm going to have to do my database stuff un...

AJR•12/13/24, 5:57 PM

It's not my favorite thing right now. You can use

wrangler dev --remote

wrangler dev --remote

which will still want a

localConnectionString

localConnectionString

but will use the actual Hyperdrive binding you give it and otherwise work like a normal worker.

Ddave @AJR is there a github ticket I can follow for it?

AJR•12/13/24, 5:57 PM

It's mostly internal work we think, so no such luck. If you file an issue on GitHub, link it here and I'll see to it that it gets updated when there's updates to be had.

dave•12/13/24, 5:59 PM

hmm, I guess I can try to use cloud-sql-proxy..

Ddave hmm, I guess I can try to use cloud-sql-proxy..

dave•12/13/24, 6:55 PM

Ended up doing this. Much safer now that I can do local dev with SSL upstream, while wrangler doesn't need to use ssl locally.

cloud-sql-proxy --port 59435 --address 127.0.0.1 'MY_CLOUD_ID:us-east4:INSTANCE_NAME'

cloud-sql-proxy --port 59435 --address 127.0.0.1 'MY_CLOUD_ID:us-east4:INSTANCE_NAME'

Ddave Ended up doing this. Much safer now that I can do local dev with SSL upstream, w...

Isaac McFadyen•12/13/24, 7:00 PM

Also allows IAM auth if you wanted to.

IIsaac McFadyen Also allows IAM auth if you wanted to.

dave•12/13/24, 7:01 PM

Aren't I still supplying the username/password manually for Hyperdrive?

Ddave Aren't I still supplying the username/password manually for Hyperdrive?

Isaac McFadyen•12/13/24, 7:06 PM

Yes, but what I mean is that if you use IAM auth locally you can have a crazy long password that's stored only in Hyperdrive (to prevent accidentally leaking it somehow)

IIsaac McFadyen Yes, but what I mean is that if you use IAM auth locally you can have a crazy lo...

dave•12/13/24, 7:26 PM

Not sure I understand, I’m already using a crazy long password.

dave•12/13/24, 7:27 PM

I would like to prevent leaking it though.

Ddave Not sure I understand, I’m already using a crazy long password.

Isaac McFadyen•12/13/24, 7:27 PM

Any time you have a password used for production infrastructure, using that same password for local development means that it's much easier to make mistakes.

IIsaac McFadyen Any time you have a password used for production infrastructure, using that same...

dave•12/13/24, 7:27 PM

Oh, I’m using a totally different database.

Isaac McFadyen•12/13/24, 7:27 PM

E.g you forget to

gitignore

gitignore

.env

.env

file, or it appears in your clipboard history, etc.

Isaac McFadyen•12/13/24, 7:27 PM

Oh OK, great.

IIsaac McFadyen Oh OK, great.

dave•12/13/24, 7:28 PM

Could I avoid using a password locally?

dave•12/13/24, 7:45 PM

hmm I think I might be on the right track..

IIsaac McFadyen Yes, but what I mean is that if you use IAM auth locally you can have a crazy lo...

dave•12/13/24, 7:46 PM

                      ^ You must provide a password - e.g.
  'user:password@database.example.com:port/databasename'

                      ^ You must provide a password - e.g.
  'user:password@database.example.com:port/databasename'

Seems like CF enforces having a password

dave•12/13/24, 7:53 PM

eh, couldn't get

--auto-iam-authn

--auto-iam-authn

to work

IIsaac McFadyen Any time you have a password used for production infrastructure, using that same...

dave•12/13/24, 8:49 PM

well, one good news is that with

cloud-sql-proxy

cloud-sql-proxy

, I can remove

0.0.0.0/0

0.0.0.0/0

in the allow IPs list in Google Cloud SQL.

dave•12/13/24, 9:00 PM

@Isaac McFadyen Do you have any opinions on what managed PostgreSQL options are the "best"? Google Cloud SQL seems to be really nice, the cost is reasonable ish, and has near zero downtime even during upgrades.

Ddave @Isaac McFadyen Do you have any opinions on what managed PostgreSQL options are ...

Isaac McFadyen•12/13/24, 9:10 PM

Not particularely. I use Cloud SQL for another project and it is quite nice, yeah.

IIsaac McFadyen Not particularely. I use Cloud SQL for another project and it is quite nice, yea...

dave•12/14/24, 4:05 AM

Thanks! We use Cloud SQL for two other projects; this is the first time we’re using it for something that runs outside of Google Cloud though.

Gerbuuun•12/15/24, 10:28 AM

I'm having trouble connecting to my supabase database wether I'm using a pooler connection or a direct connection via hyperdrive. The Hyperdrive binding is

null

null

and the pooler connection times out without ever connecting. Anyone know what might be going wrong?

Gerbuuun•12/15/24, 12:07 PM

Fixed it. I used an example where the binding was not accessed correctly

alex (he/him)•12/16/24, 7:45 AM

Hyperdrive down?

alex (he/him)•12/16/24, 7:45 AM

Starting to see weird behavior for our Workers, which I can't explain myself

Aalex (he/him)Starting to see weird behavior for our Workers, which I can't explain myself

Nick•12/16/24, 10:48 AM

"Connection terminated unexpectedly"?

Aalex (he/him)Hyperdrive down?

AJR•12/16/24, 5:15 PM

Nope. Release rolling out right now to address some corner cases with bulk inserts and very large resultsets. But that wouldn't have been going as of 10 hours ago when you messaged.

What kind of weird behavior?

dave•12/16/24, 7:52 PM

Is there any difference, in terms of programming, between using Hyperdrive vs. TCP Connect with Postgres.js?

dave•12/16/24, 7:52 PM

Just wondering if I'm doing any vendor lock-in here.

AJR•12/16/24, 7:55 PM

In terms of how you'd actually use them, if you wanted to port away, no not really. You have the option of designing your app more around cached result speed, and also you probably want to avoid transactions more than if you were using direct connections (though that's true with most any connection pooler so.. eh). Overall it should be very portable, as a part of the userbase for Hyperdrive is meant to be folks with pre-existing databases and apps trying to move onto Workers.

If you find cases where that isn't true, please do mention them here.

AAJR In terms of how you'd actually use them, if you wanted to port away, no not real...

dave•12/16/24, 7:57 PM

Thanks! This is for new applications, where we want the option to let some enterprise customers self-host (without us needing to rewrite anything).

Ddave Is there any difference, in terms of programming, between using Hyperdrive vs. T...

thomasgauvin•12/16/24, 7:57 PM

@dave | ai.moda the main difference will be using the connectionString you get from Hyperdrive (ie env.HYPERDRIVE.connectionString) instead of env.connectionString accessed as a environment variable/secret.

Frank•12/17/24, 10:45 AM

getting 500 errors when trying to create hyperdrive connection

Frank•12/17/24, 10:51 AM

not sure if this means anything

A request to the Cloudflare API (/accounts/xxxxxxxxxxx/hyperdrive/configs) failed.
Internal Server Error [code: 10000]

A request to the Cloudflare API (/accounts/xxxxxxxxxxx/hyperdrive/configs) failed.
Internal Server Error [code: 10000]

Frank•12/17/24, 10:52 AM

UI did not work either

it would be really nice to see what these errors are somehow

Similar Threads

Similar Threads

Similar Threads