Private access

Private access puts your computer or phone on the project's private network. While you're connected, you reach the project's databases, key value stores and web services at their private addresses. Nothing is opened to the internet.

Use it to run psql against a database, inspect a key value store with redis-cli, or open a private service in your browser.

Private access uses WireGuard, which is free for macOS, Windows, Linux, iOS and Android. Private access itself is free.

Add a device

The project needs at least one machine first.

1. Open the project's Networking page and select the Private access tab.
2. Under Devices, enter a name for the device, for example Ana's laptop, and click Add device.
3. The device's page opens with its WireGuard config, as text and as a QR code.

Then connect:

• On a computer, install WireGuard, click Download config and import the file into WireGuard. Turn the tunnel on.
• On a phone, install the WireGuard app, add a tunnel by scanning the QR code, and turn it on.

Give each person a device of their own, so you can remove one without affecting the others. You can download a device's config again at any time with Config next to it in the list.

What you reach

Once a device is added, the Private access tab lists everything your devices reach under What your devices reach. That's every deployed web service, database and key value store in the project, each with a private address and a name.

Use the user, password and database name from the database's connection string.

Use the name rather than the address: the name stays the same.

Your devices reach only those addresses, on the usual port for each resource (5432 for Postgres, 6379 for a key value store, 80 for a web service). Nothing else on the project's machines answers.

Each project's private addresses are its own, so you can be connected to several projects at once.

Across zones

A device reaches every zone the project has machines in. If you add a machine in a new zone later, download the device's config again and re-import it.

Remove a device

On the Private access tab, click Remove next to the device. From then on it can't connect, even with its config.

Keep the config safe

A device's config is its key to the project's network. Anyone who has it can connect. Don't share it or commit it to a repository. If a config is lost or leaked, remove the device and add a new one.

The connection is encrypted between your device and the project, and the project answers nothing without a valid key.

Limits

Where it runs

While the project has a device or a connected network, each zone it has machines in runs a small access point on one of its machines. The access point uses 32 MB of that machine's memory, listed as Private access on the project's Resources page, and costs nothing. If that machine has no room for it, adding the device says so. The access point goes away when you remove the last device and connected network.