You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Hyperdrive can securely connect to your private databases using [Cloudflare Tunnel](/cloudflare-one/connections/connect-networks/) and [Cloudflare Access](/cloudflare-one/policies/access/).
13
13
@@ -48,11 +48,13 @@ First, create a [Cloudflare Tunnel](/cloudflare-one/connections/connect-networks
48
48
49
49
Your tunnel must be configured to use a public hostname so that Hyperdrive can route requests to it. If you don't have a hostname on Cloudflare yet, you will need to [register a new hostname](/registrar/get-started/register-domain/) or [add a zone](/dns/zone-setups/) to Cloudflare to proceed.
50
50
51
+
<Steps>
51
52
1. In the **Public Hostnames** tab, choose a **Domain** and specify any subdomain or path information. This will be used in your Hyperdrive configuration to route to this tunnel.
52
53
53
54
2. In the **Service** section, specify **Type**`TCP` and the URL and configured port of your database, such as `localhost:5432` or `my-database-host.database-provider.com:5432`. This address will be used by the tunnel to route requests to your database.
54
55
55
56
3. Select **Save tunnel**.
57
+
</Steps>
56
58
57
59
:::note
58
60
If you are setting up the tunnel through the CLI instead ([locally-managed tunnel](/cloudflare-one/connections/connect-networks/do-more-with-tunnels/local-management/)), you will have to complete these steps manually. Follow the Cloudflare Zero Trust documentation to [add a public hostname to your tunnel](/cloudflare-one/connections/connect-networks/routing-to-tunnel/dns/) and [configure the public hostname to route to the address of your database](/cloudflare-one/connections/connect-networks/do-more-with-tunnels/local-management/configuration-file/).
@@ -64,26 +66,29 @@ To restrict access to the Cloudflare Tunnel to Hyperdrive, a [Cloudflare Access
64
66
65
67
The Cloudflare dashboard can automatically create and configure the underlying [Cloudflare Access application](/cloudflare-one/applications/), [Service Auth token](/cloudflare-one/policies/access/#service-auth), and [Policy](/cloudflare-one/policies/) on your behalf. Alternatively, you can manually create the Access application and configure the Policies.
66
68
67
-
<Tabs> <TabItemlabel="Automatic creation">
69
+
<Detailsheader="Automatic creation">
68
70
69
-
### 2.1 Create a Hyperdrive configuration in the Cloudflare dashboard
71
+
### 2.1. (Automatic) Create a Hyperdrive configuration in the Cloudflare dashboard
70
72
71
73
Create a Hyperdrive configuration in the Cloudflare dashboard to automatically configure Hyperdrive to connect to your Cloudflare Tunnel.
72
74
75
+
<Steps>
73
76
1. In the [Cloudflare dashboard](https://dash.cloudflare.com/?to=/:account/workers/hyperdrive), navigate to **Storage & Databases > Hyperdrive** and click **Create configuration**.
74
77
2. Select **Private database**.
75
78
3. In the **Networking details** section, select the tunnel you are connecting to.
76
79
4. In the **Networking details** section, select the hostname associated to the tunnel. If there is no hostname for your database, return to step [1.2. Connect your database using a public hostname](/hyperdrive/configuration/connect-to-private-database/#12-connect-your-database-using-a-public-hostname).
77
80
5. In the **Access Service Authentication Token** section, select **Create new (automatic)**.
78
81
6. In the **Access Application** section, select **Create new (automatic)**.
79
82
7. In the **Database connection details** section, enter the database **name**, **user**, and **password**.
83
+
</Steps>
84
+
</Details>
80
85
81
-
</TabItem>
82
-
<TabItemlabel="Manual creation">
83
-
### 2.1 Create a service token
86
+
<Detailsheader="Manual creation">
87
+
### 2.1. (Manual) Create a service token
84
88
85
89
The service token will be used to restrict requests to the tunnel, and is needed for the next step.
86
90
91
+
<Steps>
87
92
1. In [Zero Trust](https://one.dash.cloudflare.com), go to **Access** > **Service auth** > **Service Tokens**.
88
93
89
94
2. Select **Create Service Token**.
@@ -99,11 +104,13 @@ The service token will be used to restrict requests to the tunnel, and is needed
99
104
:::caution
100
105
This is the only time Cloudflare Access will display the Client Secret. If you lose the Client Secret, you must regenerate the service token.
101
106
:::
107
+
</Steps>
102
108
103
-
### 2.2 Create an Access application to secure the tunnel
109
+
### 2.2. (Manual) Create an Access application to secure the tunnel
104
110
105
111
[Cloudflare Access](/cloudflare-one/policies/access/) will be used to verify that requests to the tunnel originate from Hyperdrive using the service token created above.
106
112
113
+
<Steps>
107
114
1. In [Zero Trust](https://one.dash.cloudflare.com), go to **Access** > **Applications**.
108
115
109
116
2. Select **Add an application**.
@@ -137,8 +144,9 @@ The service token will be used to restrict requests to the tunnel, and is needed
137
144
16. Select **Next**.
138
145
139
146
17. Save the application.
147
+
</Steps>
140
148
141
-
### 2.3 Create a Hyperdrive configuration
149
+
### 2.3. (Manual) Create a Hyperdrive configuration
142
150
143
151
To create a Hyperdrive configuration for your private database, you'll need to specify the Access application and Cloudflare Tunnel information upon creation.
144
152
@@ -180,17 +188,17 @@ In addition, it will also set the Access Client ID and the Access Client Secret
180
188
When creating the Hyperdrive configuration for the private database, you must enter the `access-client-id` and the `access-client-id`, and omit the `port`. Hyperdrive will route database messages to the public hostname of the tunnel, and the tunnel will rely on its service configuration (as configured in [1.2. Connect your database using a public hostname](#12-connect-your-database-using-a-public-hostname)) to route requests to the database within your private network.
181
189
:::
182
190
183
-
</TabItem> </Tabs>
191
+
</Details>
184
192
185
193
## 3. Query your Hyperdrive configuration from a Worker (optional)
186
194
187
195
To test your Hyperdrive configuration to the database using Cloudflare Tunnel and Access, use the Hyperdrive configuration ID in your Worker and deploy it.
0 commit comments