diff --git a/src/assets/images/hyperdrive/configuration/hyperdrive-private-database-automatic-configuration.png b/src/assets/images/hyperdrive/configuration/hyperdrive-private-database-automatic-configuration.png new file mode 100644 index 00000000000000..f55069a12e0e03 Binary files /dev/null and b/src/assets/images/hyperdrive/configuration/hyperdrive-private-database-automatic-configuration.png differ diff --git a/src/content/changelogs-next/2025-01-28-hyperdrive-automated-private-database-configuration.mdx b/src/content/changelogs-next/2025-01-28-hyperdrive-automated-private-database-configuration.mdx new file mode 100644 index 00000000000000..0c54cf613b7820 --- /dev/null +++ b/src/content/changelogs-next/2025-01-28-hyperdrive-automated-private-database-configuration.mdx @@ -0,0 +1,17 @@ +--- +title: Automatic configuration for private databases on Hyperdrive +description: Hyperdrive now automatically configures your Cloudflare Tunnel to connect to your private database. +products: + - hyperdrive +date: 2025-01-28T18:00:00Z +--- + +Hyperdrive now automatically configures your Cloudflare Tunnel to connect to your private database. + +![Automatic configuration of Cloudflare Access and Service Token in the Cloudflare dashboard for Hyperdrive.](~/assets/images/hyperdrive/configuration/hyperdrive-private-database-automatic-configuration.png) + +When creating a Hyperdrive configuration for a private database, you only need to provide your database credentials and set up a Cloudflare Tunnel within the private network where your database is accessible. Hyperdrive will automatically create the Cloudflare Access, Service Token, and Policies needed to secure and restrict your Cloudflare Tunnel to the Hyperdrive configuration. + +To create a Hyperdrive for a private database, you can follow the [Hyperdrive documentation](/hyperdrive/configuration/connect-to-private-database/). You can still manually create the Cloudflare Access, Service Token, and Policies if you prefer. + +This feature is available from the Cloudflare dashboard. diff --git a/src/content/changelogs/hyperdrive.yaml b/src/content/changelogs/hyperdrive.yaml index 5c097c65fc298c..8d1bf39089e162 100644 --- a/src/content/changelogs/hyperdrive.yaml +++ b/src/content/changelogs/hyperdrive.yaml @@ -5,6 +5,14 @@ productLink: "/hyperdrive/" productArea: Developer platform productAreaLink: /workers/platform/changelog/platform/ entries: + - publish_date: "2025-01-28" + title: Hyperdrive automatically configures your Cloudflare Tunnel to connect to your private database. + description: |- + When creating a Hyperdrive configuration for a private database, you only need to provide your database credentials and set up a Cloudflare Tunnel within the private network where your database is accessible. + + Hyperdrive will automatically create the Cloudflare Access, Service Token and Policies needed to secure and restrict your Cloudflare Tunnel to the Hyperdrive configuration. + + Refer to [documentation on how to configure Hyperdrive to connect to a private database](/hyperdrive/configuration/connect-to-private-database/). - publish_date: "2024-12-11" title: Hyperdrive now caches queries in all Cloudflare locations decreasing cache hit latency by up to 90% description: |- diff --git a/src/content/docs/hyperdrive/configuration/connect-to-private-database.mdx b/src/content/docs/hyperdrive/configuration/connect-to-private-database.mdx index fc34cd4eec2e6a..ae60356fa42018 100644 --- a/src/content/docs/hyperdrive/configuration/connect-to-private-database.mdx +++ b/src/content/docs/hyperdrive/configuration/connect-to-private-database.mdx @@ -52,7 +52,29 @@ Your tunnel must be configured to use a public hostname so that Hyperdrive can r If you are setting up the tunnel through the CLI instead ([locally-managed tunnel](/cloudflare-one/connections/connect-networks/configure-tunnels/local-management/)), you will have to complete these steps manually. Follow the Cloudflare Zero Trust documentation to [add a public hostname to your tunnel](/cloudflare-one/connections/connect-networks/routing-to-tunnel/dns/) and [configure the public hostname to route to the address of your database](/cloudflare-one/connections/connect-networks/configure-tunnels/local-management/configuration-file/). ::: -## 2. Create a service token +## 2. Create and configure Hyperdrive to connect to the Cloudflare Tunnel + +To restrict access to the Cloudflare Tunnel to Hyperdrive, a [Cloudflare Access application](/cloudflare-one/applications/) must be configured with a [Policy](/cloudflare-one/policies/) that requires requests to contain a valid [Service Auth token](/cloudflare-one/policies/access/#service-auth). + +The Cloudflare dashboard can automatically create and configure the underlying [Cloudflare Access application](/cloudflare-one/applications/), [Service Auth token](/cloudflare-one/policies/access/#service-auth), and [Policy](/cloudflare-one/policies/) on your behalf. Alternatively, you can manually create the Access application and configure the Policies. + + + +### 2.1 Create a Hyperdrive configuration in the Cloudflare dashboard + +Create a Hyperdrive configuration in the Cloudflare dashboard to automatically configure Hyperdrive to connect to your Cloudflare Tunnel. + +1. In the [Cloudflare dashboard](https://dash.cloudflare.com/?to=/:account/workers/hyperdrive), navigate to **Storage & Databases > Hyperdrive** and click **Create configuration**. +2. Select **Private database**. +3. In the **Networking details** section, select the tunnel you are connecting to. +4. In the **Networking details** section, select the hostname associated to the tunnel. If there is no hostname for your database, return to step [1.2. Connect your database using a public hostname](/hyperdrive/configuration/connect-to-private-database/#12-connect-your-database-using-a-public-hostname). +5. In the **Access Service Authentication Token** section, select **Create new (automatic)**. +6. In the **Access Application** section, select **Create new (automatic)**. +7. In the **Database connection details** section, enter the database **name**, **user**, and **password**. + + + +### 2.1 Create a service token The service token will be used to restrict requests to the tunnel, and is needed for the next step. @@ -72,7 +94,7 @@ The service token will be used to restrict requests to the tunnel, and is needed This is the only time Cloudflare Access will display the Client Secret. If you lose the Client Secret, you must regenerate the service token. ::: -## 3. Create an Access application to secure the tunnel +### 2.2 Create an Access application to secure the tunnel [Cloudflare Access](/cloudflare-one/policies/access/) will be used to verify that requests to the tunnel originate from Hyperdrive using the service token created above. @@ -110,7 +132,7 @@ The service token will be used to restrict requests to the tunnel, and is needed 17. Save the application. -## 4. Create a Hyperdrive configuration +### 2.3 Create a Hyperdrive configuration To create a Hyperdrive configuration for your private database, you'll need to specify the Access application and Cloudflare Tunnel information upon creation. @@ -152,7 +174,9 @@ In addition, it will also set the Access Client ID and the Access Client Secret When creating the Hyperdrive configuration for the private database, you must enter the `access-client-id` and the `access-client-id`, and omit the `port`. Hyperdrive will route database messages to the public hostname of the tunnel, and the tunnel will rely on its service configuration (as configured in [1.2. Connect your database using a public hostname](#12-connect-your-database-using-a-public-hostname)) to route requests to the database within your private network. ::: -## 5. Query your Hyperdrive configuration from a Worker (optional) + + +## 3. Query your Hyperdrive configuration from a Worker (optional) To test your Hyperdrive configuration to the database using Cloudflare Tunnel and Access, use the Hyperdrive configuration ID in your Worker and deploy it. @@ -177,4 +201,5 @@ If you successfully receive the list of `pg_tables` from your database when you ## Troubleshooting If you encounter issues when setting up your Hyperdrive configuration with tunnels to a private database, consider these common solutions, in addition to [general troubleshooting steps](/hyperdrive/observability/troubleshooting/) for Hyperdrive: -* Ensure your database is configured to use TLS (SSL). Hyperdrive requires TLS (SSL) to connect. + +- Ensure your database is configured to use TLS (SSL). Hyperdrive requires TLS (SSL) to connect.