Hacker News Reader

Comment by conradk | Hacker News Reader

Then you lose some security though, because I think Heroku uses large IPs ranges [1]. There seems to be no way to allow database access from a private IP address, other than using expensive proxying addons. That means you probably have to open up your database to 0.0.0.0/0, which is not good at all.

[1] https://stackoverflow.com/questions/15512360/get-a-finite-li...

View on HN

Heroku has "private spaces" which will give you a fixed set of outbound IPs, AWS VPC peering, and a firewall via Trusted IP Ranges.

Heroku is surprisingly nice as an enterprise customer.

https://devcenter.heroku.com/articles/private-spaces#stable-...

Is Heroku Postgres locked down by default? Maybe I’m misremembering, but I’m pretty sure I’ve used the Heroku database url on my local machine before.

Nothing stops someone from spinning up a Heroku bash terminal and trying to access your internal DB either so it’s not markedly worse than pure Heroku.

You can get better firewall control than just open/shut

Would you mind sharing what you have in mind please? I'm genuinely interested in how that would work.

Sure, I have a PG database on the internet. It's firewall allows only traffic from my whitelist IPs. Additionally these PG servers require SSL[0] from only my CA so even if firewall is open, no access.

[0] https://www.postgresql.org/docs/current/static/ssl-tcp.html

Redis has authentication.

Reply on news.ycombinator.com