How can I secure Ratel with Community Edition DGraph?

[joaquin (Joaquin Menchaca)]

@SamJBentley

We have got a community DGraph cluster deployed in ECS. We also have Ratel in ECS, exposed over a load balancer. From what I can tell, we can only secure DGraph with the Enterprise edition, but I don’t want Ratel exposed to the internet without the possibility of securing data.

So for the Community edition, is it possible to either add a username/password to Ratel or add standard username/password access to the DGraph database (as you usually do with databases)?

Dgraph Ratel UI is a client (ReactJS single-page-application) whose UI is served by a small web service. You can run this anywhere, such as docker container or directly on your laptop. In this scope, there’s no difference between Enterprise or Community Edition.

The part that does need to be secured are the public-endpoints with the Dgraph Alpha service. Below is a list of some ways you can secure the Dgraph Alpha service and the Dgraph Ratel UI web service:

• Infrastructure (AWS) layer
  • Security Group: Add a security group for the endpoint to white list only allowed access, such as home office, and remote WFH addresses
  • TLS terminated on LB, such as ACM (AWS Certificate Manager).
  • Internal Facing LB so that it is only accessible to private networks. Then this can be accessed using bastion host or VPN. (ref. Internal Classic Load Balancers)
    • Setup bastion host (example quickstart guide) where you can setup SSH tunnel to access the private internal load balancer endpoint.
    • Setup at VPN (such as AWS Client VPN to get access to the private internal load balancer endpoint.
• Dgraph Alpha layer
  • Mutual TLS (Community and Enterprise): You can use Mutual TLS, which requires you to submit a client certificate for access. For requiring a client certificate, Dgraph Alpha server must be configured with REQUIREANDVERIFY (ref. docs)
  • Access Control Lists (Enterprise only): Enabling this will requires logging into Dgraph Alpha to get an AccessJWT token that is then used to access Dgraph Alpha. (ref. docs)
• Dgraph Ratel UI web service:
  • TLS can be added directly to the web service with -tls_crt and -tls_key arguments to dgraph_ratel.