{"action":"opened","issue":{"url":"https://api.github.com/repos/kr/beanstalkd/issues/319","repository_url":"https://api.github.com/repos/kr/beanstalkd","labels_url":"https://api.github.com/repos/kr/beanstalkd/issues/319/labels{/name}","comments_url":"https://api.github.com/repos/kr/beanstalkd/issues/319/comments","events_url":"https://api.github.com/repos/kr/beanstalkd/issues/319/events","html_url":"https://github.com/kr/beanstalkd/issues/319","id":151406914,"number":319,"title":"Support for SSL and auth ?","user":{"login":"zimbatm","id":3248,"avatar_url":"https://avatars.githubusercontent.com/u/3248?v=3","gravatar_id":"","url":"https://api.github.com/users/zimbatm","html_url":"https://github.com/zimbatm","followers_url":"https://api.github.com/users/zimbatm/followers","following_url":"https://api.github.com/users/zimbatm/following{/other_user}","gists_url":"https://api.github.com/users/zimbatm/gists{/gist_id}","starred_url":"https://api.github.com/users/zimbatm/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zimbatm/subscriptions","organizations_url":"https://api.github.com/users/zimbatm/orgs","repos_url":"https://api.github.com/users/zimbatm/repos","events_url":"https://api.github.com/users/zimbatm/events{/privacy}","received_events_url":"https://api.github.com/users/zimbatm/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2016-04-27T14:56:08Z","updated_at":"2016-04-27T14:56:08Z","closed_at":null,"body":"When deploying in the cloud it's often the case that you want to deploy beanstalkd on a remote network. An example would be if you want to use beanstalkd with a Heroku app. Because of how Heroku works, beanstalkd would have to be deployed somewhere else like for example a EC2 instance and then accessed removing from the Heroku app.\r\n\r\nRight now the protocol doesn't have a provision to secure the traffic and identify the client so the port basically has to stay open. Because Heroku doesn't provide a fixed set of IPs for a given app the best we can do is limit the access to all the IPs allocated to us-east-1.\r\n\r\nIs there anything right now that allows to control the ACL that I have been missing ? I don't think that the protocol supports it but I guess it could be fairly easy to use client SSL certificates to manage the encryption and authorization of clients as an overlay.\r\n\r\nEven within a secured network it's nice to be able to assume that it has been compromised. It allows for tighter control without having to fiddle with firewalls or network appliances.\r\n"}}