With AWS RDS, how do I give Hyperdrive the CA needed so I can use SSL?

AAJR We currently cannot support SSL handshake from local dev. It's on our roadmap, ...

daveOP•1/22/25, 1:06 PM

Is this a limitation of Hyperdrive, or local Workers in general? For context, I tried to use postgres.js without hyperdrive locally, and SSL is failing.

AJR•1/22/25, 1:14 PM

That's a fair question and I'm honestly not sure yet, part of the work to support it may help other services too. Local dev goes through miniflare same as the rest of the Workers services, which is open source.

Ddave With AWS RDS, how do I give Hyperdrive the CA needed so I can use SSL?

AJR•1/22/25, 1:15 PM

Work to support custom CAs is in flight but not publicly available yet.

AAJR Work to support custom CAs is in flight but not publicly available yet.

daveOP•1/22/25, 1:16 PM

Is Hyperdrive in production connecting to RDS without SSL right now then? (Sorry, in a government building right now and can’t pull out my laptop to test.

)

Ddave Is Hyperdrive in production connecting to RDS without SSL right now then? (Sorry...

AJR•1/22/25, 1:16 PM

It's connecting with SSL, exclusively, using the standard suite of Mozilla Web PKI CAs

Mitya•1/23/25, 2:04 PM

Struggling to set up a Tunnel to my HD. I get as far as step 7:

Once the command has finished running, your connector will appear in Zero Trust.

This doesn't happen for me - it stays empty ("No connectors installed"), even though the command ran successfully in my terminal. Any idea what I could be doing wrong?

MMitya Struggling to set up a Tunnel to my HD. I get as far as [step 7](https://develop...

AJR•1/23/25, 6:14 PM

That command runs cloudflared as a service. Generally for long-lived things that's what you want, but it may need to be started by your service manager (e.g.

systemd

systemd

or similar). For initial setup it might be easier to do it as

cloudflared tunnel run <NAME>

cloudflared tunnel run <NAME>

ZT team has pretty good docs on this, that seems like it'll be most helpful for you here.
https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/get-started/create-local-tunnel/#6-run-the-tunnel

Cloudflare Docs

Create a locally-managed tunnel (CLI) · Cloudflare Zero Trust docs

Follow this step-by-step guide to get your first tunnel up and running using the CLI.

Mitya•1/23/25, 7:51 PM

Thanks, I'll have a read of that. So it seems I was on the wrong lines. I was just following the guide in the docs (though I did wonder why I needed to download and install an MSI to set up a tunnel to a remote DB.) I'm trying to switch from IP-based connection to my Azure-hosted DB to use tunnels instead. Is that possible?

MMitya Thanks, I'll have a read of that. So it seems I was on the wrong lines. I was ju...

Isaac McFadyen•1/23/25, 8:03 PM

You'll need the Tunnel within the same VPC/network/whatever Azure calls it as the DB.

Isaac McFadyen•1/23/25, 8:04 PM

I believe with Azure you can either change the DB to be within the same VPC as a VM instance or use Private Connect (I think that's what they call it?)

Isaac McFadyen•1/23/25, 8:04 PM

Regardless, the Tunnel needs to be able to contact the Azure DB.

Mitya•1/23/25, 8:04 PM

Eeek, sounds complex. I'm no network administrator. Appreciate the info, though, I'll do some reading.

MMitya Eeek, sounds complex. I'm no network administrator. Appreciate the info, though,...

Isaac McFadyen•1/23/25, 8:05 PM

Hyperdrive can either connect over the public internet, or via a Tunnel. If you use the public internet your DB security will be weakened a bit because you'll need give it a public IP or similar. If you use a Tunnel then you can use the private IP of the DB, but whatever is running the Tunnel needs to be able to contact that private IP (that's why I mentioned VPC).

Mitya•1/23/25, 8:07 PM

Yeah at the moment my HD is connecting over public IP, which isn't ideal for the reason you mention. When you say "whatever is running the tunnel," what does that mean? Isn't that Cloudflare? I realise I'm quite ignorant here.

AJR•1/23/25, 8:07 PM

(we are working on getting over to the cloudflare IPs, to get a door #3 where you allowlist just those and could skip setting up the tunnel. it's taking a while to land, but is still coming)

MMitya Yeah at the moment my HD is connecting over public IP, which isn't ideal for the...

AJR•1/23/25, 8:08 PM

The egress end of the tunnel, where traffic leaves it and goes to your DB, has to run somewhere. That's what

cloudflared

cloudflared

does, and that's what needs to be reachable by your DB.

Isaac McFadyen•1/23/25, 8:09 PM

^ Usually that's a VM instance hosted by you, probably on Azure as otherwise there's no way for it to talk to the DB.

Isaac McFadyen•1/23/25, 8:09 PM

That's what the MSI you were using was for. If you installed that on Windows Server (or the Linux one on a Linux machine) then Hyperdrive would route through that server to contact your DB.

MMitya Thanks, I'll have a read of that. So it seems I was on the wrong lines. I was ju...

AJR•1/23/25, 8:09 PM

Just checked, @thomasgauvin did specifically test that this works with Azure, btw.

Mitya•1/23/25, 8:10 PM

Haha - I thought I was supposed to literally install that on my laptop. OK, it's becoming clearer.

thomasgauvin•1/23/25, 8:11 PM

@Mitya I have some time now if I can help answer some questions https://calendar.app.google/9C8a9s8j37WCW1e58

Appointments

Jeff•1/23/25, 8:54 PM

@thomasgauvin I'm actually implementing as well, are you available for another calendar slot?

thomasgauvin•1/23/25, 8:58 PM

Also, if anyone else wants to book a call w/ me looking for clarity on any Hyperdrive feature, any other Hyperdrive questions, things you think we should know about, or just want to share with us what you're building (we want to know!), book a chat here: https://calendar.app.google/9C8a9s8j37WCW1e58

Appointments

森

森@VerseLink (RW)•1/23/25, 9:12 PM

~~only for hyperdrive?~~

AAJR (we are working on getting over to the cloudflare IPs, to get a door #3 where yo...

daveOP•1/23/25, 10:18 PM

Please ping me when this happens

Jeff•1/23/25, 10:24 PM

learned something new today: you can skip a lot of the cloudflare one configuration if you just click hyperdrive -> private database in the CF dashboard. The only part you need to do is get cloudflared running in your network

Zn4rK•1/24/25, 11:12 AM

Are cached Hyperdrive queries invalidated if a write occurs?

ZZn4rK Are cached Hyperdrive queries invalidated if a write occurs?

AJR•1/24/25, 11:40 AM

Discussed recently:
hyperdrive

AAJR Discussed recently: https://discord.com/channels/595317990191398933/115055798623...

Zn4rK•1/24/25, 11:41 AM

Ty!

daveOP•1/25/25, 1:59 PM

Is there any plans to allow using Hyperdrive as a pooler for non-Workers connections?

Ddave Is there any plans to allow using Hyperdrive as a pooler for non-Workers connect...

AJR•1/25/25, 8:03 PM

Plans is a strong word. It's something we've discussed internally, but no firm commitments yet. If it's something you'd be interested in, I'll make sure to filter that back to our product folks.

AAJR No. You can cache-bust individual queries by including any volatile function in...

sid•1/25/25, 8:08 PM

Im using hyperdrive to cache queries to my supabase db, is there a way to cache bust a particular document. E.g. if I run a volatile query like

SELECT random() FROM table WHERE id =  1234

SELECT random() FROM table WHERE id =  1234

will the cache only be invalidated for that record or the whole table?

Ssid Im using hyperdrive to cache queries to my supabase db, is there a way to cache ...

AJR•1/25/25, 8:10 PM

We don't do any purging. If you do

SELECT random(), * FROM table WHERE id = 1234

SELECT random(), * FROM table WHERE id = 1234

you'll get uncached results for that query. What's in the cache won't be touched either way.

sid•1/25/25, 8:12 PM

ah okay understood

AAJR Plans is a strong word. It's something we've discussed internally, but no firm ...

daveOP•1/25/25, 8:45 PM

Would be quite interested.

AAJR Hey everyone. I'm looking for some beta testers. We have a fairly large change...

AJR•1/27/25, 2:39 PM

Hey everyone. Beta test has started, last call for folks who want to join.

Please reply in thread with your Hyperdrive ID if so. Thanks!

AAJR We don't do any purging. If you do `SELECT random(), * FROM table WHERE id = 123...

daveOP•1/27/25, 2:53 PM

Do you optimize this type of query by skipping even checking the cache? Or is there still a small delay due to a cache lookup miss?

Ddave Do you optimize this type of query by skipping even checking the cache? Or is th...

AJR•1/27/25, 2:54 PM

We skip checking the cache. The delay for doing so is incredibly small, but no reason to waste the traffic.

AJR•1/27/25, 2:58 PM

For the record, we are aware this is not the best UX for bypassing cache on a single query, and are hoping to find/build something better that still plays nicely with the variety of drivers/libs we want to support.

letincho5•1/27/25, 8:15 PM

Hi, I'm using Hyperdrive + Neon + Drizzle, and I've an issue: I've to connect a new connection (const db = drizzle()...) for each query, in the same "request/worker" execution. When I not use Hyperdrive, I can have a singleton of drizzle and do multiples queries.

I'm use thats imports:
import { drizzle, NodePgDatabase } from "drizzle-orm/node-postgres";

Any ideas?

Hello, I’m Allie!•1/28/25, 5:25 AM

How does Hyperdrive handle replicas now?

HHello, I’m Allie!How does Hyperdrive handle replicas now?

AJR•1/28/25, 11:21 AM

For now, the same as it always has. Folks generally make separate Hyperdrives for read replicas and direct queries there at the application level.

Jeroen•1/29/25, 4:14 AM

I get a ton of errors of this form:

[ERROR]   Error: write CONNECTION_ENDED 4386caf43864cfa4ca634cafca3a4cf2.hyperdrive.local:5432

[ERROR]   Error: write CONNECTION_ENDED 4386caf43864cfa4ca634cafca3a4cf2.hyperdrive.local:5432

What causes this? I think it is on Cloudflare's end, since I have no errors in my actual database.

Jeroen•1/29/25, 4:15 AM

Happens in about 50% of cases.

Jeroen•1/29/25, 4:29 AM

ah it was unexpected behaviour of waitUntil

Jeroen•1/29/25, 4:29 AM

I thought it'd chain but it doesn't

AAJR For now, the same as it always has. Folks generally make separate Hyperdrives fo...

daveOP•1/29/25, 1:38 PM

It would be pretty cool if Hyperdrive could automatically redirect read-only queries to the read replica server.

Ddave It would be pretty cool if Hyperdrive could automatically redirect read-only que...

AJR•1/29/25, 1:39 PM

It's something we're kicking around, definitely not a Q1 project but enough folks have mentioned it that I'll be surprised if we don't end up shipping it this year.

thomasgauvin•1/29/25, 5:10 PM

Hey folks! We announced the new automatic configuration for Hyperdrive's support for private databases over tunnels. You may have caught this previously, but now you only need to setup your tunnel in your virtual network/VPC where you can access your database, and then Hyperdrive will automatically configure the tunnel to be restricted to Hyperdrive

https://developers.cloudflare.com/changelog-next/2025-01-28-hyperdrive-automated-private-database-configuration/

hyperdrive-private-database-automatic-configuration.png

With AWS RDS, how do I give Hyperdrive the CA needed so I can use SSL?

Similar Threads

Similar Threads

Similar Threads