Addresses and protocols

Esta página aún no está traducida al español: aquí la tienes en inglés.

The default address

Every app has https://<app name>-<project>.glac.run, where <project> is six characters of the project’s id. It has it from the moment it is made; renaming the app changes it. glac cube get and the app’s url show it.

Requests to it pass through a proxy in front of the platform, which handles TLS and keeps floods of traffic (DDoS) away. The proxy has limits of its own: request bodies of at most 100 MB, and answers that pause for at most 125 seconds. For more, give the app direct: true (glac cube update api --direct true): it then also answers at direct_url, under direct.glac.run, which skips the proxy and has only the platform’s own limits in front of it. Addresses has the proxy’s limits and the direct names of every product side by side.

Every app and every sandbox link has a name of its own under glac.run. Until glac.run is on the Public Suffix List, a page under one of them can set a cookie for all of glac.run that other customers’ pages can read. Keep your app’s cookies to its own name (no Domain attribute), and do not trust cookies scoped to the whole domain.

Your own domain

POST /v1/domains with {"domain": "api.example.com", "app": "api"} points a name of yours at an app (or {domain, sandbox, port} at a port of a sandbox). The answer lists the DNS records that prove the name is yours:

• Through the proxy (the default, proxied: true): a CNAME from your name to <token>.glac.run. The proxy checks the name and issues its certificate.
• Direct (proxied: false): a CNAME to <token>.direct.glac.run; or, for a name at the top of a domain, which cannot have a CNAME, a TXT record at _sandbox-domain.<your name> with the token, and the name’s A and AAAA records pointed at the addresses the answer gives.

The certificate is issued and renewed for you. Every address of the name must point at the platform, and nobody else’s proxy or CDN may stand in front of a direct name. Keep the record in your DNS after the name works: without it the certificate is not renewed.

glac domains create api.example.com --app api does the same and prints the record, glac domains ls, get, update and rm do the rest, and so do the SDKs (glac.domains in Python) and the MCP server’s domain_* tools.

A domain’s status is pending_verification, pending_certificate, active or detached (its app or sandbox was deleted). Deploys and rollbacks need no change to the domain: it follows the app. A project has at most 100 domains (403 domain_limit_reached). Registering, changing and deleting a domain needs a key with the admin scope.

Apps with no address on the internet

An app with public: false (--public false) has no default address. Other services and sandboxes of the project reach it on the project’s private network, at <app name>.internal, and domains pointed at it still work. See services and Compose.

Protocols

Clients reach an app over HTTP/1.1, HTTP/2 or HTTP/3. A request that comes over HTTP/2 or HTTP/3 reaches your service over HTTP/2 without TLS (h2c) when your service speaks it, and over HTTP/1.1 when it does not. Nothing needs to be set: the platform asks the port once. A request that comes over HTTP/1.1 reaches it over HTTP/1.1.

• gRPC works when your service speaks HTTP/2 without TLS, which a gRPC server on a plain port does (gRPC-Go, tonic, grpc-js, grpcio): unary calls, streams in either or both directions, metadata, trailers and status codes pass through as they are. Call it at the app’s address on port 443 with TLS.
• A call or a stream is one request, however long it stays open and however many messages pass on it. While it is open the instance is awake and metered as awake, so give long streams a deadline.
• Trace headers. A request’s traceparent and tracestate (W3C Trace Context) reach your service as the client sent them, over HTTP/1.1 and HTTP/2 alike, unless the app has the platform take part in its requests’ traces (its traces): then your service gets the platform’s own traceparent, whose span is the parent of yours, and the client’s tracestate only where the app takes the client’s trace. See traces.
• WebSockets come over HTTP/1.1. One stays open while the instance sleeps, and new data on it wakes the instance.
• Connections to your service are shared. After an answer, the platform keeps its connection to the instance’s port open for a moment (a second for an instance without a key, 200 milliseconds for a keyed instance or a sandbox) and sends the next request on it, which may be another client’s; over HTTP/2, one connection carries every client’s requests already. So a service that ties a login to its TCP connection, as NTLM does, cannot stand behind these addresses. A connection kept so does not keep the instance awake.