Hacker News Reader

Comment by koolba | Hacker News Reader

You can have it both ways by leveraging the free / hobby tier of Heroku with bringing your own data store. Nothing binds you to their resource providers. Just add an environment variable for your own database or Redis provider.

View on HN

Then you lose some security though, because I think Heroku uses large IPs ranges [1]. There seems to be no way to allow database access from a private IP address, other than using expensive proxying addons. That means you probably have to open up your database to 0.0.0.0/0, which is not good at all.

[1] https://stackoverflow.com/questions/15512360/get-a-finite-li...

Nothing stops someone from spinning up a Heroku bash terminal and trying to access your internal DB either so it’s not markedly worse than pure Heroku.

You can get better firewall control than just open/shut

Would you mind sharing what you have in mind please? I'm genuinely interested in how that would work.

Sure, I have a PG database on the internet. It's firewall allows only traffic from my whitelist IPs. Additionally these PG servers require SSL[0] from only my CA so even if firewall is open, no access.

[0] https://www.postgresql.org/docs/current/static/ssl-tcp.html

Is Heroku Postgres locked down by default? Maybe I’m misremembering, but I’m pretty sure I’ve used the Heroku database url on my local machine before.

Redis has authentication.

Heroku has "private spaces" which will give you a fixed set of outbound IPs, AWS VPC peering, and a firewall via Trusted IP Ranges.

Heroku is surprisingly nice as an enterprise customer.

https://devcenter.heroku.com/articles/private-spaces#stable-...

Reply on news.ycombinator.com