Can I use the dedicated IP address for outbound traffic?

[jakeshead]

I have pgbouncer set up as an app, and am connecting to supabase with it. I want to use supabase’s network restrictions to allow only connection from fly, so I purchased a dedicated IP address and assigned it to the app, then set up supabase to restrict to only that IP. Unfortunately this appears to only affect inbound connections, rather than outbound. Is there a way to make this work?

I have confirmed that setting supabase’s IP restriction to the assigned IP of the VM that pgbouncer is running on works; so, theoretically, if I could change the IP of the VM to the dedicated IP I bought for the app, this might work. Outbound is the only thing that matters.

[ignoramous]

Don’t think that’s possible on Fly, yet:

Outbound IP Address

Yes that’s the best way to do it! We don’t have stable outbound IPs yet, so IP restrictions are a no go. They’re also pretty brittle and doing wireguard peers is a much better answer for talking to private services.

You could experiment with bind/connect explicitly on FLY_PUBLIC_IP (ipv6) to see if works:

Static egress IP

I haven’t tried this, but another user wonders if can clients/servers bind their socket to FLY_PUBLIC_IP, which might then give both a stable ingress (in case of clients via experimental.allowed_public_ports) and egress (if the server process binding to that IP works).

[jakeshead]

Bummer. Supabase don’t support wireguard (yet). I can’t really get comfortable with DB endpoints that don’t have any network security. I wish Fly’s docs about public networking made this a little clearer, as this may have been a wasted chunk of hours.

[ignoramous]

@jakeshead

I can’t really get comfortable with DB endpoints that don’t have any network security.

I am surprised there isn’t a way to secure access to Supabase backend other than allowlisting IPs. Sounds archaic.

@jakeshead

Bummer. Supabase don’t support wireguard (yet).

Kurt is an investor in Supabase, and so could help figure this out. Doubt Kurt is free enough these days though to help out individual customers like he has in the past.

@jakeshead

I wish Fly’s docs about public networking made this a little clearer

True. You could consider sending a pull request: https://github.com/superfly/docs/blob/main/reference/services.html.md.erb