Connected networks

A connected network joins one of your own networks to the project, such as an office network or a network at AWS, Google Cloud or Azure. Your project's services reach the services you name in it, and machines in that network reach your project's services at their private addresses.

Use it when an app on Appentic needs something that lives elsewhere, such as a database in another cloud, a server in your office, or a partner's API you reach over a private link.

The link uses WireGuard. Your network needs something that can run it, such as a router or firewall with WireGuard support, or a small Linux server.

Connect a network

The project needs at least one machine first.

1. Open the project's Networking page and select the Connected networks tab.

2. Under Connect a network, fill in the fields:

   Field	What to enter
   Name	A name for the network, for example Office.
   Its address ranges	The network's address ranges, for example 10.20.0.0/16. Separate several with commas.
   Its WireGuard address (optional)	Where the network's WireGuard listens, for example vpn.example.com:51820. Leave it empty if your side starts the connection, for example when it has no public address.
   Services in it	Click Add service for each service your project needs, and enter its name, address and port, for example office-db, 10.20.1.5, 5432 and erp-api, 10.20.1.8, 8080.

3. Click Connect.

The network's page opens with the WireGuard config for your network's side. Load it on that side's WireGuard and turn it on.

On your network's side, allow traffic from the addresses under AllowedIPs in the config, and route replies to them back through WireGuard. If you left Its WireGuard address empty, your side connects to Appentic and keeps the link up.

Reach its services

Your project's services reach each service you named at its name and port, in every zone:

psql "postgresql://USER:PASSWORD@office-db:5432/DATABASE"
curl http://erp-api:8080/health

Your project's services reach only the services you name. To add or change one, open the network's page, edit Services in it under Settings and click Save. Changes apply within a minute.

A service name uses lower case letters, digits and dashes, starts with a letter, and can't be a name another service in the project already has. Each service's address must be inside the network's ranges.

Reach your project from the network

Machines in the connected network reach your project's web services, databases and key value stores at their private addresses. These are the same addresses and names shown on the Private access tab. Machines in the network reach them even where traffic rules limit which of your services may.

Address ranges

A network's ranges must be IPv4, no wider than a /8, and can't overlap:

• each other, or another connected network's ranges
• the ranges Appentic uses itself: 10.42.0.0/16, 10.43.0.0/16, 10.254.0.0/24, 10.255.0.0/24 and 100.64.0.0/10

If your network uses one of these, connect a part of it that doesn't, or contact support.

Limits

Disconnect a network

On the network's page, click Disconnect network and confirm. Its services stop being reachable from the project, and its config stops working.

Price

A connected network has a monthly service fee, billed by the second. It also uses the project's free private access point. See Private access and How billing works.