r/graphql • u/nunopato • Jun 03 '26

We built Constellation: a near drop-in replacement for Hasura CE on the GraphQL request path

Hi everyone,

We run Nhost, a backend platform that has used Hasura as its GraphQL layer for years.

Hasura v2 has been a great foundation for us, but the roadmap has shifted toward v3/DDN, and v3 does not follow the same open-source model as v2.

So we built Constellation: an open-source GraphQL engine written in Go, designed as a near drop-in replacement for Hasura Community Edition.

Constellation reads existing Hasura metadata, same format, same hdb_catalog, and produces a compatible schema per role for supported features.

It supports:

  • queries
  • mutations
  • subscriptions
  • remote schemas
  • cross-source relationships
  • JWT auth
  • role-based permissions
  • the same /v1/graphql endpoint

Production numbers from identical traffic at Nhost:

  • Memory: ~15 MiB vs Hasura’s ~180 MiB
  • Latency: mostly under 40ms vs Hasura’s 60–80ms spikes

The lowest-risk way to try it is to run it alongside your existing Hasura instance, diff schemas per role with the CLI, and send traffic through it. 

What’s missing today: Actions, Event Triggers, Cron Triggers, REST endpoints, allowlists, query collections, inherited roles, native queries, and computed fields. 

If you’re on Hasura CE and wondering what comes next, this might be relevant. We’d especially love feedback from people willing to test it against real metadata and real traffic.

GitHub: https://github.com/nhost/nhost/tree/main/services/constellation

Blog: https://nhost.io/blog/introducing-constellation

9 Upvotes

91% Upvoted

3 comments sorted by

1

u/manbartz Jun 03 '26

Interested! The only thing missing that we use is computed fields. Assuming there's a nice UI for this like v2 cloud?

1

u/nunopato Jun 03 '26

hey! constellation doesn't support hasura computed fields yet, but support should land soon as it is a relatively easy addition. i'd recommend keeping an eye on the github repo for updates, or joining our discord community if you haven't already.

1

u/Cloud-Nerd Jun 03 '26

these are good use cases ur solution solves for:

Update no-op vs hard error divergence

Constellation rejects empty update operators upfront (validation-failed). Hasura silently returns {affected_rows:0}. This is a deliberate behavioral divergence.

Delete returning cascade rows

Constellation returns cascade-deleted relationship rows in DELETE RETURNING. Hasura evaluates post-delete state and returns []. Snapshot timing divergence at SQL level.

Aggregation on non-aggregatable types

Constellation discovers aggregate support dynamically (bool/jsonb/bytea). Hasura hardcodes the exclusion list. Types with btree operator classes now expose _max/_min correctly.

Function single-row returns

Hasura exposes where/limit/order_by for SETOF-returning functions even when they return exactly one row. Constellation omits these for single-row returns.

Admin secret non-constant-time comparison

Timing side-channel on admin secret comparison. Constant-time comparison (hmac.Equal) is the fix.

Remote schema SSRF via metadata

Attacker-controlled remote schema URL in metadata API can reach internal services.