How networking works
What reaches what inside a project, across zones, from the internet and to the internet.
Every project has a private network of its own. Everything in the project can reach everything else in it over that network, and nothing outside the project can. Two projects never share a network, even in the same workspace.
You then choose what else gets in and out:
| You want | Use |
|---|---|
| Your own computer or phone to reach your databases and services without opening them to the internet | Private access |
| A web service that only your other services can call, such as an internal API | Private services |
| One address your services reach the internet from, for a bank or partner to allow | Fixed outbound address |
| Your office or cloud network joined to the project | Connected networks |
| To limit what your services can reach on the internet, or which services can reach a database | Traffic rules |
| A tool or person outside Appentic, such as a BI tool, to connect to a database | Public access on that database |
The Networking page
Open Networking in the project's sidebar. The Overview tab has four sections:
| Section | What it shows |
|---|---|
| Addresses | Every web service, database, key value store and load balancer, with its address In the project, over Private access, and From the internet (or Not public). |
| Connections | Which web services, workers and cron jobs are connected to which databases and key value stores, and whether each connection stays in its zone (Same zone) or goes Through the tunnel. |
| Zones | Each zone the project has machines in, the state of its tunnel, and the typical round trip between each pair of zones. |
| Outbound | The public address each machine reaches the internet from. |
The other tabs are Private access, Connected networks, Outbound address and Traffic rules. Each has its own page in this section.
Inside a project
Your services reach each other at their addresses in the project:
| Resource | Address in the project |
|---|---|
| Web service | http:// followed by its name, for example http://api. Spaces and capitals become dashes and lower case, so Shop Front is http://shop-front. The web service's Settings page shows the exact address. |
| Postgres database | Its host and port, in DATABASE_URL |
| Key value store | Its host and port, in REDIS_URL |
When you connect a database or key value store to a service, the service gets the connection details as environment variables. See Environment variables.
Workers and cron jobs have no address. They only make outgoing connections.
Across zones
A project can have machines in more than one zone, for example EU-1 and US-1. Its zones are joined by an encrypted tunnel of their own, so across zones:
- a service reaches a database or key value store with the same connection details as one next to it
- every zone reaches a private service at its
http://name - load balancers and the fixed outbound address cover every zone
A public web service's http:// name works only within its own zone. To call it from another zone, use its public address or make it private.
Every call from a service to a database in another zone takes at least the round trip between the two zones. The Zones section shows it, for example about 109 ms between EU-1 and US-1. Keep each database in the zone of the services that use it most. See Machines in several zones.
From the internet
| Resource | Reachable from the internet |
|---|---|
| Web service | Yes, over HTTPS at its appentic.app address and any custom domains, unless you make it private. |
| Load balancer | Yes, at its own appentic.app address. See Load balancers. |
| Postgres database | No, unless you turn on public access for chosen addresses. |
| Key value store, worker, cron job | Never. |
| Storage | Buckets are reached with their endpoint and access key. See Storage. |
A firewall can stand in front of your public web services and load balancers.
To the internet
Your services can reach anything on the internet. They connect from the public address of the machine they run on, listed under Outbound on the Overview.
- For one address across all your machines, use a fixed outbound address.
- To allow only what you list, turn on Limit outbound traffic in traffic rules.