dgraph

clusters (one Zero coordinator + N Alpha data nodes grouped at a
configurable replication factor) and a pure-Go dgo-based client that
can target either the local cluster or any reachable remote cluster
(e.g. Dgraph Cloud, an existing self-hosted cluster).

File map (all `package main`, surfaced as one Dagger module):

- security.go — *ServerSecurity / *ClientSecurity + the
Plaintext / TLS / mTLS constructors and the
server-profile validation.
- serversecurity.go — mounts the caller-supplied TLS material onto
each Alpha / Zero container and renders the
`--tls` superflag args.
- cluster.go — *Cluster + Dgraph.Cluster, input validation,
the topology builder (one Zero + N Alphas),
and the Stop / GrpcEndpoints / HttpEndpoints /
BindAlphas / Client methods (with mode
coupling).
- client.go — *Client + Dgraph.Client, dgo wiring including
the client-side *tls.Config, and the DropAll /
AlterSchema / Mutate / RunQuery / QueryWithVars
method set.

Installation

dagger install github.com/z5labs/devex/daggerverse/dgraph@a17bf411228ae3d544c7c18bcf08dd04c295d453

Entrypoint

Return Type

Dgraph

Example

dagger -m github.com/z5labs/devex/daggerverse/dgraph@a17bf411228ae3d544c7c18bcf08dd04c295d453 call \

func (m *MyModule) Example() *dagger.Dgraph  {
	return dag.
			Dgraph()
}

@function
def example() -> dagger.Dgraph:
	return (
		dag.dgraph()
	)

@func()
example(): Dgraph {
	return dag
		.dgraph()
}

Types

Dgraph 🔗

Dgraph is the root namespace for every exported function in this module. All cluster constructors, security helpers, and the remote-client factory hang off *Dgraph so the generated Dagger SDK surfaces them under dag.Dgraph().<Func>(...).

client() 🔗

Client constructs a dgo-backed Dgraph client that targets the given gRPC endpoints (each of the form host:9080). No I/O happens at construction time. Works against the local Cluster() topology or any reachable remote cluster — Dgraph Cloud, an existing self-hosted cluster, anything that speaks the Dgraph gRPC API.

Return Type

Client !

Arguments

Name	Type	Default Value	Description
grpcEndpoints	[String ! ] !	-	No description provided
security	ClientSecurity !	-	No description provided

Example

echo 'Custom types are not supported in shell examples'

func (m *MyModule) Example(grpcEndpoints []string, security *dagger.DgraphClientSecurity) *dagger.DgraphClient  {
	return dag.
			Dgraph().
			Client(grpcEndpoints, security)
}

@function
def example(grpcendpoints: List[str], security: dagger.DgraphClientSecurity) -> dagger.DgraphClient:
	return (
		dag.dgraph()
		.client(grpcendpoints, security)
	)

@func()
example(grpcEndpoints: string[], security: DgraphClientSecurity): DgraphClient {
	return dag
		.dgraph()
		.client(grpcEndpoints, security)
}

cluster() 🔗

Cluster spins up a Dgraph cluster of one Zero coordinator and alphas Alpha data nodes, with Alphas grouped at replication factor replicas (so every group is exactly replicas Alphas large; alphas % replicas == 0 is required). All listeners use plaintext in this story.

Image: <registry>/dgraph/dgraph:<tag> — the dgraph/dgraph portion is fixed; only registry and tag are caller-overridable.

Rejected inputs (each surfaces a descriptive error rather than booting a half-broken cluster):

zeros != 1 — multi-Zero quorum needs every peer’s address at static config time via --peer, which Dagger’s WithServiceBinding model can’t express without an unresolvable cycle. Multi-Zero HA lands in a follow-up.
alphas < 1 or replicas < 1.
replicas > 1 && replicas % 2 == 0 — Dgraph’s Raft consensus needs an odd replica count per group (or replicas == 1 for no replication).
alphas % replicas != 0 — every Dgraph group must be full.
clientListenerSecurity == nil — plaintext must be a deliberate caller choice so a future TLS upgrade stays explicit.

Session-cached so that repeated chained method calls on the returned cluster (e.g. Client.Mutate → Client.RunQuery in client-mutate-then-query-round-trip) observe the SAME underlying services — and therefore the same graph state. The acceptance criteria suggest a never-cache here, but under never-cache the engine re-spawns the cluster between Mutate and Query in the same test, losing the data the prior Mutate wrote (verified during impl). Every method on *Cluster and *Client is independently marked never-cache, so any data-returning call re-executes per invocation.

name is a caller-supplied discriminator that folds into the session cache key. Parallel test suites should pass a unique value per test (e.g. the test function name) so each test gets its own backing services — without it, every same-shape call collapses to one cached cluster and concurrent tests race on shared schema and storage. Same name + same shape still cache-hits, which is what a single test’s chained Client.Mutate → Client.RunQuery sequence needs. Leaving the default empty is fine for ad-hoc dagger call use where only one cluster is in play.

Return Type

Cluster !

Arguments

Name	Type	Default Value	Description
name	String !	""	No description provided
zeros	Integer !	1	No description provided
alphas	Integer !	1	No description provided
replicas	Integer !	1	No description provided
registry	String !	"docker.io"	No description provided
tag	String !	"v24.0.4"	No description provided
clientListenerSecurity	ServerSecurity !	-	No description provided

Example

echo 'Custom types are not supported in shell examples'

func (m *MyModule) Example(name string, zeros int, alphas int, replicas int, registry string, tag string, clientListenerSecurity *dagger.DgraphServerSecurity) *dagger.DgraphCluster  {
	return dag.
			Dgraph().
			Cluster(name, zeros, alphas, replicas, registry, tag, clientListenerSecurity)
}

@function
def example(name: str, zeros: int, alphas: int, replicas: int, registry: str, tag: str, clientlistenersecurity: dagger.DgraphServerSecurity) -> dagger.DgraphCluster:
	return (
		dag.dgraph()
		.cluster(name, zeros, alphas, replicas, registry, tag, clientlistenersecurity)
	)

@func()
example(name: string, zeros: number, alphas: number, replicas: number, registry: string, tag: string, clientListenerSecurity: DgraphServerSecurity): DgraphCluster {
	return dag
		.dgraph()
		.cluster(name, zeros, alphas, replicas, registry, tag, clientListenerSecurity)
}

mtlsClientSecurity() 🔗

MtlsClientSecurity returns a ClientSecurity profile that opens a mutual-TLS connection: the Alpha is verified against serverCa and the client presents clientCert + clientKey to satisfy the listener’s REQUIREANDVERIFY client-auth requirement.

Return Type

ClientSecurity !

Arguments

Name	Type	Default Value	Description
serverCa	File !	-	No description provided
clientCert	File !	-	No description provided
clientKey	Secret !	-	No description provided

Example

dagger -m github.com/z5labs/devex/daggerverse/dgraph@a17bf411228ae3d544c7c18bcf08dd04c295d453 call \
 mtls-client-security --server-ca file:path --client-cert file:path --client-key env:MYSECRET

func (m *MyModule) Example(serverCa *dagger.File, clientCert *dagger.File, clientKey *dagger.Secret) *dagger.DgraphClientSecurity  {
	return dag.
			Dgraph().
			Mtlsclientsecurity(serverCa, clientCert, clientKey)
}

@function
def example(serverca: dagger.File, clientcert: dagger.File, clientkey: dagger.Secret) -> dagger.DgraphClientSecurity:
	return (
		dag.dgraph()
		.mtlsclientsecurity(serverca, clientcert, clientkey)
	)

@func()
example(serverCa: File, clientCert: File, clientKey: Secret): DgraphClientSecurity {
	return dag
		.dgraph()
		.mtlsClientSecurity(serverCa, clientCert, clientKey)
}

mtlsServerSecurity() 🔗

MtlsServerSecurity returns a ServerSecurity profile that terminates mutual TLS. In addition to the server leaf (serverCert and serverKey), clientCa is passed as the --tls "ca-cert=…" value and client-auth-type=REQUIREANDVERIFY, so connecting clients must present a certificate signed by clientCa.

Return Type

ServerSecurity !

Arguments

Name	Type	Default Value	Description
serverCert	File !	-	No description provided
serverKey	Secret !	-	No description provided
clientCa	File !	-	No description provided

Example

dagger -m github.com/z5labs/devex/daggerverse/dgraph@a17bf411228ae3d544c7c18bcf08dd04c295d453 call \
 mtls-server-security --server-cert file:path --server-key env:MYSECRET --client-ca file:path

func (m *MyModule) Example(serverCert *dagger.File, serverKey *dagger.Secret, clientCa *dagger.File) *dagger.DgraphServerSecurity  {
	return dag.
			Dgraph().
			Mtlsserversecurity(serverCert, serverKey, clientCa)
}

@function
def example(servercert: dagger.File, serverkey: dagger.Secret, clientca: dagger.File) -> dagger.DgraphServerSecurity:
	return (
		dag.dgraph()
		.mtlsserversecurity(servercert, serverkey, clientca)
	)

@func()
example(serverCert: File, serverKey: Secret, clientCa: File): DgraphServerSecurity {
	return dag
		.dgraph()
		.mtlsServerSecurity(serverCert, serverKey, clientCa)
}

plaintextClientSecurity() 🔗

PlaintextClientSecurity returns a ClientSecurity profile configured for unencrypted, unauthenticated traffic to the cluster’s Alphas.

Return Type

ClientSecurity !

Example

dagger -m github.com/z5labs/devex/daggerverse/dgraph@a17bf411228ae3d544c7c18bcf08dd04c295d453 call \
 plaintext-client-security

func (m *MyModule) Example() *dagger.DgraphClientSecurity  {
	return dag.
			Dgraph().
			Plaintextclientsecurity()
}

@function
def example() -> dagger.DgraphClientSecurity:
	return (
		dag.dgraph()
		.plaintextclientsecurity()
	)

@func()
example(): DgraphClientSecurity {
	return dag
		.dgraph()
		.plaintextClientSecurity()
}

plaintextServerSecurity() 🔗

PlaintextServerSecurity returns a ServerSecurity profile configured for unencrypted, unauthenticated traffic on every cluster listener.

Return Type

ServerSecurity !

Example

dagger -m github.com/z5labs/devex/daggerverse/dgraph@a17bf411228ae3d544c7c18bcf08dd04c295d453 call \
 plaintext-server-security

func (m *MyModule) Example() *dagger.DgraphServerSecurity  {
	return dag.
			Dgraph().
			Plaintextserversecurity()
}

@function
def example() -> dagger.DgraphServerSecurity:
	return (
		dag.dgraph()
		.plaintextserversecurity()
	)

@func()
example(): DgraphServerSecurity {
	return dag
		.dgraph()
		.plaintextServerSecurity()
}

tlsClientSecurity() 🔗

TlsClientSecurity returns a ClientSecurity profile that opens a one-way TLS connection and verifies the Alpha against serverCa.

Return Type

ClientSecurity !

Arguments

Name	Type	Default Value	Description
serverCa	File !	-	No description provided

Example

dagger -m github.com/z5labs/devex/daggerverse/dgraph@a17bf411228ae3d544c7c18bcf08dd04c295d453 call \
 tls-client-security --server-ca file:path

func (m *MyModule) Example(serverCa *dagger.File) *dagger.DgraphClientSecurity  {
	return dag.
			Dgraph().
			Tlsclientsecurity(serverCa)
}

@function
def example(serverca: dagger.File) -> dagger.DgraphClientSecurity:
	return (
		dag.dgraph()
		.tlsclientsecurity(serverca)
	)

@func()
example(serverCa: File): DgraphClientSecurity {
	return dag
		.dgraph()
		.tlsClientSecurity(serverCa)
}

tlsServerSecurity() 🔗

TlsServerSecurity returns a ServerSecurity profile that terminates one-way TLS on every Dgraph listener. serverCert is the PEM leaf certificate (its SAN must cover the Alpha / Zero hostnames the client dials) and serverKey is the matching PEM private key. Dgraph starts each node with --tls "server-cert=…; server-key=…"; the default client-auth-type=VERIFYIFGIVEN means clients need not present a certificate, so a plain TlsClientSecurity connects cleanly.

Return Type

ServerSecurity !

Arguments

Name	Type	Default Value	Description
serverCert	File !	-	No description provided
serverKey	Secret !	-	No description provided

Example

dagger -m github.com/z5labs/devex/daggerverse/dgraph@a17bf411228ae3d544c7c18bcf08dd04c295d453 call \
 tls-server-security --server-cert file:path --server-key env:MYSECRET

func (m *MyModule) Example(serverCert *dagger.File, serverKey *dagger.Secret) *dagger.DgraphServerSecurity  {
	return dag.
			Dgraph().
			Tlsserversecurity(serverCert, serverKey)
}

@function
def example(servercert: dagger.File, serverkey: dagger.Secret) -> dagger.DgraphServerSecurity:
	return (
		dag.dgraph()
		.tlsserversecurity(servercert, serverkey)
	)

@func()
example(serverCert: File, serverKey: Secret): DgraphServerSecurity {
	return dag
		.dgraph()
		.tlsServerSecurity(serverCert, serverKey)
}

Client 🔗

Client is a dgo-backed Dgraph client. Each method opens a fresh gRPC connection so the function call is stateless from Dagger’s perspective.

alterSchema() 🔗

AlterSchema applies the given DQL schema (predicate definitions, types, indexes) to the cluster.

Return Type

Void !

Arguments

Name	Type	Default Value	Description
schema	String !	-	No description provided

Example

echo 'Custom types are not supported in shell examples'

func (m *MyModule) Example(ctx context.Context, name string, zeros int, alphas int, replicas int, registry string, tag string, clientListenerSecurity *dagger.DgraphServerSecurity, security *dagger.DgraphClientSecurity, schema string)   {
	return dag.
			Dgraph().
			Cluster(name, zeros, alphas, replicas, registry, tag, clientListenerSecurity).
			Client(security).
			Alterschema(ctx, schema)
}

@function
async def example(name: str, zeros: int, alphas: int, replicas: int, registry: str, tag: str, clientlistenersecurity: dagger.DgraphServerSecurity, security: dagger.DgraphClientSecurity, schema: str) -> None:
	return await (
		dag.dgraph()
		.cluster(name, zeros, alphas, replicas, registry, tag, clientlistenersecurity)
		.client(security)
		.alterschema(schema)
	)

@func()
async example(name: string, zeros: number, alphas: number, replicas: number, registry: string, tag: string, clientListenerSecurity: DgraphServerSecurity, security: DgraphClientSecurity, schema: string): Promise<void> {
	return dag
		.dgraph()
		.cluster(name, zeros, alphas, replicas, registry, tag, clientListenerSecurity)
		.client(security)
		.alterSchema(schema)
}

dropAll() 🔗

DropAll wipes every predicate, type, and triple from the cluster.

Return Type

Void !

Example

echo 'Custom types are not supported in shell examples'

func (m *MyModule) Example(ctx context.Context, name string, zeros int, alphas int, replicas int, registry string, tag string, clientListenerSecurity *dagger.DgraphServerSecurity, security *dagger.DgraphClientSecurity)   {
	return dag.
			Dgraph().
			Cluster(name, zeros, alphas, replicas, registry, tag, clientListenerSecurity).
			Client(security).
			Dropall(ctx)
}

@function
async def example(name: str, zeros: int, alphas: int, replicas: int, registry: str, tag: str, clientlistenersecurity: dagger.DgraphServerSecurity, security: dagger.DgraphClientSecurity) -> None:
	return await (
		dag.dgraph()
		.cluster(name, zeros, alphas, replicas, registry, tag, clientlistenersecurity)
		.client(security)
		.dropall()
	)

@func()
async example(name: string, zeros: number, alphas: number, replicas: number, registry: string, tag: string, clientListenerSecurity: DgraphServerSecurity, security: DgraphClientSecurity): Promise<void> {
	return dag
		.dgraph()
		.cluster(name, zeros, alphas, replicas, registry, tag, clientListenerSecurity)
		.client(security)
		.dropAll()
}

mutate() 🔗

Mutate applies a JSON set mutation to the cluster. setJson is the JSON-encoded payload (e.g. {"name":"Alice"} or {"set":[...]} — dgo’s SetJson field is the raw value array form). If commit is true the mutation commits as a single transaction; if false the transaction is discarded (dry run) and no triples are persisted.

Returns the assigned-UIDs JSON object ({"<blank-node>":"<uid>"}) as a string.

Return Type

String !

Arguments

Name	Type	Default Value	Description
setJson	String !	-	No description provided
commit	Boolean !	-	No description provided

Example

echo 'Custom types are not supported in shell examples'

func (m *MyModule) Example(ctx context.Context, name string, zeros int, alphas int, replicas int, registry string, tag string, clientListenerSecurity *dagger.DgraphServerSecurity, security *dagger.DgraphClientSecurity, setJson string, commit bool) string  {
	return dag.
			Dgraph().
			Cluster(name, zeros, alphas, replicas, registry, tag, clientListenerSecurity).
			Client(security).
			Mutate(ctx, setJson, commit)
}

@function
async def example(name: str, zeros: int, alphas: int, replicas: int, registry: str, tag: str, clientlistenersecurity: dagger.DgraphServerSecurity, security: dagger.DgraphClientSecurity, setjson: str, commit: bool) -> str:
	return await (
		dag.dgraph()
		.cluster(name, zeros, alphas, replicas, registry, tag, clientlistenersecurity)
		.client(security)
		.mutate(setjson, commit)
	)

@func()
async example(name: string, zeros: number, alphas: number, replicas: number, registry: string, tag: string, clientListenerSecurity: DgraphServerSecurity, security: DgraphClientSecurity, setJson: string, commit: boolean): Promise<string> {
	return dag
		.dgraph()
		.cluster(name, zeros, alphas, replicas, registry, tag, clientListenerSecurity)
		.client(security)
		.mutate(setJson, commit)
}

queryWithVars() 🔗

QueryWithVars runs a parameterised DQL query and returns the response JSON body verbatim. varsJson is a JSON-encoded string-to- string map of variable bindings (e.g. {"$name":"Alice"}); Dagger’s function signatures don’t support Go map parameters so the map is passed as JSON across the module boundary.

Return Type

String !

Arguments

Name	Type	Default Value	Description
dql	String !	-	No description provided
varsJson	String !	-	No description provided

Example

echo 'Custom types are not supported in shell examples'

func (m *MyModule) Example(ctx context.Context, name string, zeros int, alphas int, replicas int, registry string, tag string, clientListenerSecurity *dagger.DgraphServerSecurity, security *dagger.DgraphClientSecurity, dql string, varsJson string) string  {
	return dag.
			Dgraph().
			Cluster(name, zeros, alphas, replicas, registry, tag, clientListenerSecurity).
			Client(security).
			Querywithvars(ctx, dql, varsJson)
}

@function
async def example(name: str, zeros: int, alphas: int, replicas: int, registry: str, tag: str, clientlistenersecurity: dagger.DgraphServerSecurity, security: dagger.DgraphClientSecurity, dql: str, varsjson: str) -> str:
	return await (
		dag.dgraph()
		.cluster(name, zeros, alphas, replicas, registry, tag, clientlistenersecurity)
		.client(security)
		.querywithvars(dql, varsjson)
	)

@func()
async example(name: string, zeros: number, alphas: number, replicas: number, registry: string, tag: string, clientListenerSecurity: DgraphServerSecurity, security: DgraphClientSecurity, dql: string, varsJson: string): Promise<string> {
	return dag
		.dgraph()
		.cluster(name, zeros, alphas, replicas, registry, tag, clientListenerSecurity)
		.client(security)
		.queryWithVars(dql, varsJson)
}

runQuery() 🔗

RunQuery runs a DQL read-only query and returns the response JSON body verbatim (the data object Dgraph returns).

Named RunQuery rather than Query because Dagger Go SDK codegen allocates a struct field named after the lowercase method name to cache the result, and query collides with the always-present querybuilder field on every generated object type. RunQuery sidesteps the collision (runQuery is unique) while preserving the verb-noun shape callers expect.

Return Type

String !

Arguments

Name	Type	Default Value	Description
dql	String !	-	No description provided

Example

echo 'Custom types are not supported in shell examples'

func (m *MyModule) Example(ctx context.Context, name string, zeros int, alphas int, replicas int, registry string, tag string, clientListenerSecurity *dagger.DgraphServerSecurity, security *dagger.DgraphClientSecurity, dql string) string  {
	return dag.
			Dgraph().
			Cluster(name, zeros, alphas, replicas, registry, tag, clientListenerSecurity).
			Client(security).
			Runquery(ctx, dql)
}

@function
async def example(name: str, zeros: int, alphas: int, replicas: int, registry: str, tag: str, clientlistenersecurity: dagger.DgraphServerSecurity, security: dagger.DgraphClientSecurity, dql: str) -> str:
	return await (
		dag.dgraph()
		.cluster(name, zeros, alphas, replicas, registry, tag, clientlistenersecurity)
		.client(security)
		.runquery(dql)
	)

@func()
async example(name: string, zeros: number, alphas: number, replicas: number, registry: string, tag: string, clientListenerSecurity: DgraphServerSecurity, security: DgraphClientSecurity, dql: string): Promise<string> {
	return dag
		.dgraph()
		.cluster(name, zeros, alphas, replicas, registry, tag, clientListenerSecurity)
		.client(security)
		.runQuery(dql)
}

ClientSecurity 🔗

ClientSecurity describes how a dgo client authenticates to a Dgraph Alpha. PLAINTEXT dials an unencrypted gRPC listener; TLS pins the server CA and verifies the Alpha’s certificate; MTLS additionally presents a client certificate + key. The client builds a *tls.Config from this PEM material and hands it to dgo via grpc.WithTransportCredentials(credentials.NewTLS(cfg)).

Cluster 🔗

Cluster represents a running Dgraph cluster: a single Zero coordinator plus N Alpha data nodes grouped at the requested replication factor. Holds references to every service so callers can bind them into their own containers or open a dgo Client against them.

alphaHostNames() 🔗

AlphaHostNames returns the cluster’s Alpha hostnames (no port), for callers that need to reference an Alpha by name from a container attached via BindAlphas.

Return Type

[String ! ] !

Example

echo 'Custom types are not supported in shell examples'

func (m *MyModule) Example(ctx context.Context, name string, zeros int, alphas int, replicas int, registry string, tag string, clientListenerSecurity *dagger.DgraphServerSecurity) []string  {
	return dag.
			Dgraph().
			Cluster(name, zeros, alphas, replicas, registry, tag, clientListenerSecurity).
			Alphahostnames(ctx)
}

@function
async def example(name: str, zeros: int, alphas: int, replicas: int, registry: str, tag: str, clientlistenersecurity: dagger.DgraphServerSecurity) -> List[str]:
	return await (
		dag.dgraph()
		.cluster(name, zeros, alphas, replicas, registry, tag, clientlistenersecurity)
		.alphahostnames()
	)

@func()
async example(name: string, zeros: number, alphas: number, replicas: number, registry: string, tag: string, clientListenerSecurity: DgraphServerSecurity): Promise<string[]> {
	return dag
		.dgraph()
		.cluster(name, zeros, alphas, replicas, registry, tag, clientListenerSecurity)
		.alphaHostNames()
}

bindAlphas() 🔗

BindAlphas attaches every Alpha service to the given container under the same hostname GrpcEndpoints / HttpEndpoints reports, so the container can dial Alphas using the same address strings as a dgo Client returned from Cluster.Client.

Return Type

Container !

Arguments

Name	Type	Default Value	Description
ctr	Container !	-	No description provided

Example

echo 'Custom types are not supported in shell examples'

func (m *MyModule) Example(name string, zeros int, alphas int, replicas int, registry string, tag string, clientListenerSecurity *dagger.DgraphServerSecurity, ctr *dagger.Container) *dagger.Container  {
	return dag.
			Dgraph().
			Cluster(name, zeros, alphas, replicas, registry, tag, clientListenerSecurity).
			Bindalphas(ctr)
}

@function
def example(name: str, zeros: int, alphas: int, replicas: int, registry: str, tag: str, clientlistenersecurity: dagger.DgraphServerSecurity, ctr: dagger.Container) -> dagger.Container:
	return (
		dag.dgraph()
		.cluster(name, zeros, alphas, replicas, registry, tag, clientlistenersecurity)
		.bindalphas(ctr)
	)

@func()
example(name: string, zeros: number, alphas: number, replicas: number, registry: string, tag: string, clientListenerSecurity: DgraphServerSecurity, ctr: Container): Container {
	return dag
		.dgraph()
		.cluster(name, zeros, alphas, replicas, registry, tag, clientListenerSecurity)
		.bindAlphas(ctr)
}

client() 🔗

Client starts every Alpha service in the cluster and returns a dgo Client wired with their gRPC endpoints.

The supplied ClientSecurity mode must match the cluster’s client-facing listener mode (PLAINTEXT/TLS/MTLS); a mismatch returns an error naming both modes rather than failing opaquely at the wire. Readiness is then verified with the client itself — a gRPC schema query retried until the Alphas report a Raft leader — so an mTLS listener is polled over mTLS using the caller’s own cert material (the only way to authenticate the probe against a REQUIREANDVERIFY listener). Dgraph.Client (the standalone constructor) has no cluster reference and therefore cannot perform the mode check; callers reaching a listener via a mismatched standalone client fail at the wire instead.

Return Type

Client !

Arguments

Name	Type	Default Value	Description
security	ClientSecurity !	-	No description provided

Example

echo 'Custom types are not supported in shell examples'

func (m *MyModule) Example(name string, zeros int, alphas int, replicas int, registry string, tag string, clientListenerSecurity *dagger.DgraphServerSecurity, security *dagger.DgraphClientSecurity) *dagger.DgraphClient  {
	return dag.
			Dgraph().
			Cluster(name, zeros, alphas, replicas, registry, tag, clientListenerSecurity).
			Client(security)
}

@function
def example(name: str, zeros: int, alphas: int, replicas: int, registry: str, tag: str, clientlistenersecurity: dagger.DgraphServerSecurity, security: dagger.DgraphClientSecurity) -> dagger.DgraphClient:
	return (
		dag.dgraph()
		.cluster(name, zeros, alphas, replicas, registry, tag, clientlistenersecurity)
		.client(security)
	)

@func()
example(name: string, zeros: number, alphas: number, replicas: number, registry: string, tag: string, clientListenerSecurity: DgraphServerSecurity, security: DgraphClientSecurity): DgraphClient {
	return dag
		.dgraph()
		.cluster(name, zeros, alphas, replicas, registry, tag, clientListenerSecurity)
		.client(security)
}

grpcEndpoints() 🔗

GrpcEndpoints returns the host:port pairs each Alpha advertises on its external gRPC listener (port 9080), suitable for passing to dgo. Explicitly Starts each Alpha and waits for it to report healthy before returning so module-runtime callers can dial immediately.

Return Type

[String ! ] !

Example

echo 'Custom types are not supported in shell examples'

func (m *MyModule) Example(ctx context.Context, name string, zeros int, alphas int, replicas int, registry string, tag string, clientListenerSecurity *dagger.DgraphServerSecurity) []string  {
	return dag.
			Dgraph().
			Cluster(name, zeros, alphas, replicas, registry, tag, clientListenerSecurity).
			Grpcendpoints(ctx)
}

@function
async def example(name: str, zeros: int, alphas: int, replicas: int, registry: str, tag: str, clientlistenersecurity: dagger.DgraphServerSecurity) -> List[str]:
	return await (
		dag.dgraph()
		.cluster(name, zeros, alphas, replicas, registry, tag, clientlistenersecurity)
		.grpcendpoints()
	)

@func()
async example(name: string, zeros: number, alphas: number, replicas: number, registry: string, tag: string, clientListenerSecurity: DgraphServerSecurity): Promise<string[]> {
	return dag
		.dgraph()
		.cluster(name, zeros, alphas, replicas, registry, tag, clientListenerSecurity)
		.grpcEndpoints()
}

httpEndpoints() 🔗

HttpEndpoints returns the host:port pairs each Alpha advertises on its HTTP listener (port 8080). Waits for each Alpha to report healthy. Once the cluster’s client-facing listener is TLS or mTLS the entries are prefixed with https:// so HTTP callers dial the encrypted listener; plaintext clusters return the scheme-less host:8080 form (unchanged from the MVP). GrpcEndpoints stays scheme-less in every mode — dgo takes a bare host:9080.

Return Type

[String ! ] !

Example

echo 'Custom types are not supported in shell examples'

func (m *MyModule) Example(ctx context.Context, name string, zeros int, alphas int, replicas int, registry string, tag string, clientListenerSecurity *dagger.DgraphServerSecurity) []string  {
	return dag.
			Dgraph().
			Cluster(name, zeros, alphas, replicas, registry, tag, clientListenerSecurity).
			Httpendpoints(ctx)
}

@function
async def example(name: str, zeros: int, alphas: int, replicas: int, registry: str, tag: str, clientlistenersecurity: dagger.DgraphServerSecurity) -> List[str]:
	return await (
		dag.dgraph()
		.cluster(name, zeros, alphas, replicas, registry, tag, clientlistenersecurity)
		.httpendpoints()
	)

@func()
async example(name: string, zeros: number, alphas: number, replicas: number, registry: string, tag: string, clientListenerSecurity: DgraphServerSecurity): Promise<string[]> {
	return dag
		.dgraph()
		.cluster(name, zeros, alphas, replicas, registry, tag, clientListenerSecurity)
		.httpEndpoints()
}

stop() 🔗

Stop tears down every service container backing this cluster (the Zero plus every Alpha). Tests should call this in a defer so each service span closes when the test returns. SIGKILL skips graceful shutdown — Dgraph’s shutdown path waits on Raft drain timeouts that a torn-down test cluster doesn’t need.

Return Type

Void !

Example

echo 'Custom types are not supported in shell examples'

func (m *MyModule) Example(ctx context.Context, name string, zeros int, alphas int, replicas int, registry string, tag string, clientListenerSecurity *dagger.DgraphServerSecurity)   {
	return dag.
			Dgraph().
			Cluster(name, zeros, alphas, replicas, registry, tag, clientListenerSecurity).
			Stop(ctx)
}

@function
async def example(name: str, zeros: int, alphas: int, replicas: int, registry: str, tag: str, clientlistenersecurity: dagger.DgraphServerSecurity) -> None:
	return await (
		dag.dgraph()
		.cluster(name, zeros, alphas, replicas, registry, tag, clientlistenersecurity)
		.stop()
	)

@func()
async example(name: string, zeros: number, alphas: number, replicas: number, registry: string, tag: string, clientListenerSecurity: DgraphServerSecurity): Promise<void> {
	return dag
		.dgraph()
		.cluster(name, zeros, alphas, replicas, registry, tag, clientListenerSecurity)
		.stop()
}

ServerSecurity 🔗

ServerSecurity describes how a Dgraph cluster’s listeners authenticate and encrypt traffic. Three modes are supported, applied uniformly to every Alpha (client-facing HTTP :8080 / gRPC :9080) and Zero (admin HTTP :6080) listener via Dgraph’s unified --tls superflag:

PLAINTEXT — unencrypted, unauthenticated traffic on every listener.
TLS — one-way TLS: each node presents a server certificate and clients verify it against the CA they hold. Dgraph’s client-auth-type=VERIFYIFGIVEN (the default) means clients are not required to present a certificate.
MTLS — mutual TLS: connecting clients must additionally present a certificate signed by ClientCa (client-auth-type=REQUIREANDVERIFY).

The cert material is caller-supplied PEM: Dgraph reads it natively via the --tls "server-cert=…; server-key=…; ca-cert=…" superflag.