Getting started / Porting from Heroku /
Add-ons

Add-ons

Heroku add-ons were third-party services provisioned through the Heroku marketplace and wired in via config vars. Tapitalee add-ons are AWS services (and a few containers) provisioned in your AWS account and wired in the same way: a variable such as DATABASE_URL appears in the app, and any IAM policies and security-group rules are handled for you.

Things to know up front:

  • Add-ons are created with tapit create <type> ..., and managed generically with tapit list addons, tapit show addon name=..., tapit delete addon name=.... See Add-On Management.
  • Adding or removing an add-on redeploys the app so containers pick up the new variables (Heroku did the same via a new release).
  • Add-ons can be shared with other apps in the same team and region (tapit create addon:share), like Heroku’s heroku addons:attach. See Add-On Sharing.
  • Provisioning takes real AWS time: an RDS instance can take 5-15 minutes. tapit list addons --wait blocks until everything is ready.
  • There is no marketplace billing; costs appear on your AWS bill (plus third-party services like Datadog or Cloudflare that you sign up for directly).

Equivalence table

Heroku add-on / feature Tapitalee Notes
Heroku Postgres RDS engine=postgres See Databases.
ClearDB / JawsDB MySQL RDS engine=mysql  
Heroku Redis / Heroku Key-Value Store, Redis Cloud, RedisGreen ElastiCache engine=redis Serverless option available.
MongoDB Atlas, mLab DocumentDB (tapit create documentdb) MongoDB-compatible, injects MONGO_URL. Or keep using Atlas over the internet.
Bucketeer, AWS S3 via config vars S3 No access keys needed: the task IAM role has bucket access.
Persistent disk (none on Heroku) EFS Shared network volume mounted into every container.
Automated Certificate Management, SSL Endpoint SecureProxy or CertWrapper Let’s Encrypt via Traefik.
Cloudflare (external) Cloudflare add-on Cloudflare Tunnel; no open inbound ports, WAF and DNS at Cloudflare.
DNS provider / PointDNS Route53 Keeps A records for your Domains up to date after each deploy.
Heroku Scheduler, Advanced Scheduler, Cron To Go Scheduled commands Built in, cron syntax.
Release phase Pre-deploy steps Built in.
Papertrail, Logentries, Coralogix, Sumo Logic (log drains) CloudWatch Logs (tapit show logs) or Datadog See below.
Datadog, New Relic, Scout, AppSignal, Librato Datadog add-on; other APMs via their agent gem/library APMs that work over HTTPS from inside the app need no add-on.
Heroku Metrics / language runtime metrics tapit show metrics (CloudWatch) Per process and per add-on.
Edge / CDN add-ons, Fastly CloudFront (tapit create cloudfront) S3-backed asset CDN, injects ASSET_HOST.
Heroku Connect, Kafka, Heroku Streaming None built in Use AWS MSK/Kinesis or a SaaS provider directly.
Review apps Preview apps Built in.
Heroku Exec / SSH into dyno tapit run bash New container, not the running one.
VPN / Private Spaces peering Tailscale, SSH Server Reach the VPC (databases, Redis) from your laptop.
Private Spaces trusted IP ranges allowed_ip_ranges on the default process Also on RDS and EC2 add-ons.
Heroku Backups (AWS Backup style) Backup add-on (tapit create backup) Scheduled AWS Backup of RDS/EFS/EC2 with optional vault lock.
Custom AWS access via keys in config vars IAM Policy Attach AWS managed or custom IAM policies to the app role. Use the SDK default credential chain instead of AWS_ACCESS_KEY_ID.
Heroku Platform API from inside the app Tapitalee CLI add-on Injects a read-only TAPIT_TOKEN.
Sidecar-like features (Nginx buildpack, etc.) Sidecar Run any extra container alongside the app.
Small VMs (none) EC2 For software that does not fit a container workflow.
Serverless functions (none) Lambda (tapit create lambda)  

Config var differences

Heroku add-ons picked their own variable names (REDIS_URL, REDISCLOUD_URL, MONGODB_URI, BUCKETEER_BUCKET_NAME, …). Tapitalee defaults are:

Add-on Default variable Change with
RDS DATABASE_URL variable=
ElastiCache REDIS_URL variable=
DocumentDB MONGO_URL variable=
S3 S3_BUCKET fixed
EFS EFS_MOUNT_POINT variable=
CloudFront ASSET_HOST, ASSET_S3_BUCKET variable_prefix=
Smokescreen HTTP_PROXY, HTTPS_PROXY, ALL_PROXY fixed
Datadog DD_* fixed

If your code expects a Heroku-specific name, either pass variable=REDISCLOUD_URL when creating the add-on, or leave the default and change the code. Connection URLs use the same postgres://, mysql:// and redis:// formats Heroku used, so most frameworks need no change.

Tapitalee also injects TAP_APP_NAME, TAP_DEPLOY_NUMBER, TAP_DOCKER_TAG and friends, roughly the role of Heroku’s HEROKU_APP_NAME / HEROKU_RELEASE_VERSION from the Dyno Metadata labs feature. See System Variables.

Common Heroku add-ons without a Tapitalee equivalent

Static outbound IPs (QuotaGuard Static, Fixie, Proximo)

Not provided. Tapitalee containers run on Fargate with dynamic public addresses; there is no NAT gateway or static egress IP option, and no proxy add-on for it.

Alternatives:

  • If the third party needs to allowlist you, run a small EC2 instance in the VPC as a forward proxy (e.g. Squid or tinyproxy) and point your app at it via HTTP_PROXY/HTTPS_PROXY. Each EC2 add-on gets an Elastic IP that does not change for the lifetime of the add-on.
  • Ask the third party for an authentication mechanism other than IP allowlisting (mTLS, signed requests, API keys).

Static inbound IPs / SSL Endpoint with fixed IP

Not provided. Inbound addresses change with each deploy. Point DNS at the *.dns.tapitalee.net hostname via CNAME, or let the Route53 or Cloudflare add-ons keep records current. Cloudflare gives your users a stable anycast IP if a fixed inbound address is genuinely required.

Log drains (Papertrail, Logentries, LogDNA, Coralogix)

No drain mechanism. Logs are written to CloudWatch Logs in your account and read with tapit show logs. Options:

  • Use the Datadog add-on with enable_logging=true, which forwards container logs to Datadog and lets tapit show logs search Datadog.
  • Configure a CloudWatch Logs subscription filter in AWS to forward to any destination (Lambda, Kinesis, a vendor’s Firehose integration).
  • Have the application log directly to the vendor over HTTPS using their library.

Transactional email (SendGrid, Mailgun, Postmark)

Not provided. These were resold via the marketplace but are ordinary SaaS products; sign up directly and set the API key as a secret variable (tapit set variable SENDGRID_API_KEY ... secret=yes). Amazon SES is also available in your AWS account and can be granted via an IAM Policy attachment with no credentials in variables.

Search (Bonsai Elasticsearch, SearchBox, Algolia)

Not provided. Use Amazon OpenSearch Service created manually in the same VPC/region (Tapitalee’s VPC and security group IDs are listed via tapit list resources), or a SaaS provider over HTTPS. You can also run your own as a Tapitalee app, using their provided container images.

Message queues (CloudAMQP RabbitMQ, Heroku Kafka)

Not provided. Redis-backed queues (Sidekiq, Celery, BullMQ) move to ElastiCache. For RabbitMQ or Kafka use Amazon MQ or MSK created manually, or grant SQS/SNS access with an IAM Policy and use the AWS SDK.

Heroku Connect (Salesforce sync)

Not provided. Consider AWS AppFlow or a Salesforce integration library.

Error tracking and APM (Sentry, Rollbar, New Relic, Scout, Honeybadger)

No add-on needed. These all work from inside the container over HTTPS; install the library and set the DSN/licence key as a secret variable. Only Datadog has a dedicated add-on because its agent runs as a sidecar container.

Heroku Postgres extras (Dataclips, Data Explorer, pg:diagnose)

Not provided. Use psql from tapit run bash, or connect a desktop client through the SSH Server or Tailscale add-ons. RDS Performance Insights is available in the AWS console for diagnostics.

Where to go next