Can't connect through Digital Ocean firewall with a new organisation running the same service

[greg]

Hi,

That does seem strange

Do you mean the request goes:

a) request → DigitalOcean → Fly.io?

or

b) request → Fly.io → DigitalOcean?

Only the issue you might be running into is that you can whitelist the Fly-provided IP for incoming connections (to the Fly network, on to the VM). Since that is fixed and you know what it is. So that’s fine for (a).

However you can’t get a fixed outgoing IP from Fly. If your setup is (b). You can’t fix the IP the request will come from. You could grab the current one that happens to be used. But that is subject to change so I wouldn’t want to rely on that for production (I assume if you have a dev environment using that approach that’s not so much of a problem as that wouldn’t matter if the IP did change).

Outbound IP Address

Yes that’s the best way to do it! We don’t have stable outbound IPs yet, so IP restrictions are a no go. They’re also pretty brittle and doing wireguard peers is a much better answer for talking to private services.