IP range whitelist for admin/export

[cyphercider]

As a followup to: https://discuss.dgraph.io/t/ip-range-whitelist-for-admin-export/2024/2

When running a multi-container application, triggering a dgraph export from another docker container is not possible because /admin/export restricts availability to localhost of the container dgraph is running in. Allowing a whitelist exception (maybe just a new dgraph commandline argument would be easiest?) for a range of IPs would solve this problem.

NOTE: it would be great to obtain a stream of the export file so it could be dumped to a storage location outside of the dgraph container.

[cyphercider]

Hi @pawanrawal and @peterstace, update on this from our side. We are moving our production instances to Amazon ECS / Fargate. However, from what I've been able to discern, unless I modify the dgraph container to open up port 22 and accept SSH connections, I'm not able to get a bash prompt open in the container at all, which prohibits me from running /admin/export at all. Because this would prohibit us from backing up any of our dgraph instances, this makes this issue urgent for us. Maybe you guys know a way around this without adding this whitelist feature? If not, do you think it could possibly be prioritized? A simple "allow export from any IP" command line flag would suffice, as we tightly control network access to our Dgraph containers anyway.

A further complication is we are currently running Dgraph v0.8.3 and won't be refactored to use 1.x until ~March 2018. Is there any way you would release a v0.8.4 tag with this feature in the short term?

P.S., a couple of threads discussing the issue with ECS / Fargate are Here and Here

[peterstace]

The quickest/easiest workaround would be for you to modify the source manually and run your own dgraph version.

The part of the code you'd want to modify is in cmd/dgraph/main.go in the handlerInit function (just remove the check for the loopback device at the end of the function).

[cyphercider]

Thanks @peterstace, we will proceed with a custom dgraph build until the standard feature is available

[pawanrawal]

This is part of v1.0.5, see https://docs.dgraph.io/deploy/#dgraph-administration.