Item — HN Reader

We were considering TigerBeetle, but found blockers:

* We use Cloudflare Workers. TigerBeetle client app is not supported. It might work using Cloudflare Containers, but then the reason we use Cloudflare is for the Workers. --> https://github.com/tigerbeetle/tigerbeetle/issues/3177

* TigerBeetle doesn't support any auth. It means the containing server (e.g. a VPS) must restrict by IP. Problem is, serverless doesn't have fixed IP. --> https://github.com/tigerbeetle/tigerbeetle/issues/3073

4 comments

But Cloudflare Workers or AWS Lambda setup would not work anyway with any db?

* spawning 1000 workers all opening a connection to a db,

* solved by service/proxy in front of db,

* proxy knows how to reach db anyway, let's do private network and not care about auth

DBs like DynamoDB work great with these kinds of runtimes, they don't need a connection pool in front

Cloudflare has its own DB (D1, Sqlite-derived), but you can also connect with PostgreSQL using their adapter (Hyperdrive). I have used both, they're okay.

I wouldn't recommend D1 for now due to its harsh storage limitations (10 GB).

Wireguard would be an answer here, IP's are authenticated with ECC keys.

Yes, this is what we also recommend, amongst other solutions. The building blocks are orthogonal.

You should chat to our solutions team, who'd be able to help you solve auth etc. at the logical level with end-to-end encryption, something we typically do for our customers.

I might not be able to afford paid support yet since it's just PoC, but if it's okay to be public, could they respond to the GitHub issue instead so it can benefit others? https://github.com/tigerbeetle/tigerbeetle/issues/3073

Appreciate your transparency that it's still a PoC, we'll chime in there. (But see also Wireguard and stunnel, depending on what your policy needs are, we try to keep policy out of TB as much as possible, and just give you great primitives)

Wait, what? A database in 2025 doesn't support any kind of auth? A financial database? WTF?

C'mon folks, the least you can do is put a guide for adding an auth proxy or auth layer on your site.

Particularly since you don't use HTTP (cant easily tell from the docs, I'm assuming), then folks are going to be left wondering: "well how the hell do I add an auth proxy without HTTP" and just put it on the open internet...

Joran from TigerBeetle here!

TigerBeetle is our open source contribution. We want to make a technical contribution to the world. And we have priorities on the list of things we want to support, and support properly, with high quality, in time.

At the same time, it's important I think that we encourage ourselves and each other here, you and I, to show respect to projects that care about craftsmanship and doing things properly, so that we don't become entitled and take open source projects and maintainers in general for granted.

Let's keep it positive!

> TigerBeetle is our open source contribution.

Wait, is it open source?? Since when? I always thought it was proprietary

Apache 2.0 since day 0, since it came out of a non-profit central bank switch by the Gates Foundation, which is also Apache 2.0.

Our view is that this kind of infrastructure is simply too valuable, too critical, not to be open source.

For more about our open source and business philosophies, which we see as orthogonal, see this interview we did with Jerod Santo: https://www.youtube.com/watch?v=Z0kzYlCTUuc

Exactly my thoughts, and yes, it's not HTTP. Not a big deal, I guess, if they explain how to work around it...

You are not entitled to anyone else's free labor.