heroku-buildpack-borealis-pg-ssh VS Dokku

So how does an app connect? I wrote a Heroku buildpack to take care of that seamlessly (borealis/postgres-ssh). When you add the buildpack to an app, it automatically identifies any config variables from my add-on and sets up a persistent SSH local port forwarding connection to the database server using autossh. The app can then connect to the database via a standard PostgreSQL client library using the add-on's DATABASE_URL config variable without having to be aware of the SSH connection in any way. In other words, application code doesn't have to change at all to support it. If the app works with the first-party Heroku Postgres add-on, it should work with my add-on, too.

Having used Heroku extensively at my previous job I became aware of what I perceived to be a major drawback of database add-ons in Heroku's marketplace: they all seem to allow connections directly from the public internet (or at least from anywhere on AWS's network) for the sake of convenience for app developers (and probably the add-on developers too!). That way, an app developer need only to retrieve the DB connection URL from the corresponding config variable (i.e. environment variable) in application code to connect to the DB. But leaving DB servers exposed to the whole world seems a clear violation of security best practices.

Heroku has a solution to this problem, of course: Private Spaces. In a private space, your app's dynos and some of its add-ons are hosted together within a virtual private cloud (VPC) that is firewalled off from the rest of the internet. It comes with a couple important caveats, however: you have to have a Heroku Enterprise account (which is expensive and requires you to give up the option to use some of the cheaper dyno types) and it only supports a handful of select add-ons (only first party, it seems) to be sequestered within the app's VPC.

My new add-on service aims to provide an alternative that sits somewhere between the extreme simplicity and relative inexpensiveness of DB add-ons running on the Common Runtime and the considerably more expensive Private Spaces while offering a similar level of security as Private Spaces. It's called Borealis Isolated Postgres and its in beta now (the beta is free): https://elements.heroku.com/addons/borealis-pg

With my add-on, each DB server is in a PostgreSQL-compatible Amazon Aurora cluster isolated within its own VPC. All connections to a DB server are required to be forwarded through an SSH server that is dedicated to that VPC.

So how does an app connect? I wrote a Heroku buildpack to take care of that seamlessly (https://github.com/OldSneerJaw/heroku-buildpack-borealis-pg-ssh). When you add the buildpack to an app, it automatically identifies any config variables from my add-on and sets up a persistent SSH local port forwarding connection to the database server using autossh. The app can then connect to the database via a standard PostgreSQL client library using the add-on's DATABASE_URL config variable without having to be aware of the SSH connection. In other words, application code doesn't have to change at all to support it. If the app works with the first-party Heroku Postgres add-on, it should work with my add-on, too.

Connecting from your local machine or a CI server to a database server is also straightforward. I wrote a Heroku CLI plugin (https://www.npmjs.com/package/borealis-pg-cli) with a couple simple commands to either run DB scripts (e.g. DB migrations to be executed during CI/CD) or open a persistent tunnel locally (e.g. for ad hoc data administration). It also has a few commands for managing which PostgreSQL extensions/modules are installed since the app user does not have privileges to do so in SQL (remember, it's a managed DB service).

During the beta all add-ons are provisioned in a multi-tenant environment to keep costs down, but when released into general availability, each premium add-on will operate in its own fully isolated VPC that is only accessible via private SSH server. I have not yet decided whether I will continue to provide a free, multi-tenant option after GA, though.

If you're already a Heroku user, you can provision the add-on directly (for free) here: https://dashboard.heroku.com/provision-addon?addonServiceId=de00ba11-8b65-47cd-b099-9605703a6e30&planId=beb31eff-e2df-4750-b73a-29542c3dc79f

Docs are here: https://devcenter.heroku.com/articles/borealis-pg#getting-started

Let me know what you think!

Would be great to see a comparison to some better known alternatives like

- Dokku [0]

- CapRover [1]

[0] https://dokku.com/

[1] https://caprover.com/

If you want to dig into it anyways, Dokku is an interesting mention. They provide an Open Source PaaS that you can install on your server to simplify self hosting containers.

When I came across Coolify, I thought of giving it a try. I am aware of Dokku, but I never really tried it because it doesn't have a UI. I work primarily as a UI developer, so having a nice UI to work with is a plus for me.

I run all my projects on Dokku. It’s a sweet spot for me between a barebones VPS with Docker Compose and something a lot more complicated like k8s. Dokku comes with a bunch of solid plugins for databases that handle backups and such. Zero downtime deploys, TLS cert management, reverse proxies, all out of the box. It’s simple enough to understand in a weekend and has been quietly maintained for many years. The only downside is it’s meant mostly for single server deployments, but I’ve never needed another server so far.

https://dokku.com/

Yeah there are a bunch of selfhostable things:

Caprover (https://caprover.com/)

Dokku (https://github.com/dokku/dokku)

But people still choose Netlify and Vercel for ease of use I think.

Maybe we need something that's just Netlify. The closest I've seen to the "right" UX is Ness:

https://ness.sh

The modern iteration of these tools has taken the developer experience learnings from the Platform as a Service (PaaS) category, and will bring them to your own VM, giving you your own personal PaaS. Example of this include Dokku, Coolify, Caprover, Cloud66 and many more!

Based on the fact that your ideal is to have a similar experience to heroku than managing your own server setting up reverse proxies take a look at these options:

1) https://dokku.com - lets you turn your light sail instance basically into heroku

2) https://render.com

3) https://fly.io

4) If you have aws credits this is their heroku equivalent: https://aws.amazon.com/elasticbeanstalk

above is not what I do but would be the options I would pursue if I understand your preference and requirement correctly.

All in all, I really recommend trying out Dokku if you are a developer interested in hosting your own projects. It makes it super easy to get everything you need to get up and running without having to worry about the specifics. And the price is impossible to beat!

The installation instructions are on the frontpage of our site. Thats basically all you need to do to install Dokku. As far as using it, we have a simplified tutorial here.