Private networking

Every app, database and cache on a team shares a private network. Your apps call each other directly, inside velixir's network, without a public URL and without going out through the internet and back.

It's on for every team, on every plan, at no extra cost. There's nothing to set up.

Calling another app

Each app has a private address:


http://<app-slug>.internal

So an api app is http://api.internal to the rest of your team. It always points at the app's live release, through deploys, rollbacks and slot swaps.

  • Port 80 reaches the app on the port it listens on (PORT).
  • The app's own port works too: http://api.internal:8080.
  • Plain HTTP. Traffic between your apps stays inside the private network, so there's no TLS to set up. Use HTTPS on the public URL for anything that leaves it.

The longer form, http://internal.vx-<app-slug>.svc.cluster.local, also works and doesn't rely on the short name.

Find an app's private address on its Processes tab, or in the API as privateHostname.

Keep an app private

An app is still reachable on its public URL unless you lock that down. For a service only your other apps should call (an internal API, an admin tool, a model server), check the request in the app itself, for example a shared secret in an environment variable, and don't publish its public URL. Calls over the private address never pass through the edge's rate limits or WAF, which is what makes them fast, and also why the app should check who's calling.

Who can connect

  • Your team's apps reach each other on any port.
  • Your team's databases and caches are reachable from your apps, as they always were.
  • Other teams can't. Every app's network only admits its own team, the edge, and itself.
  • Copies and previews are kept out. Forks, Rewind previews and Replay copies run with the original app's variables, and a pull request preview runs whatever branch was pushed, so all of them are left off the private network: none of them can call your live app on its private address.

Workers and cron jobs

Workers and cron jobs are part of their app and share its private address book: a worker can call http://api.internal like the web process can.