Addresses

Questa pagina non è ancora tradotta in italiano: eccola in inglese.

Every public address of a Cube and of a sandbox’s link has two forms. The proxied one, which you get unless you ask otherwise, reaches the platform through a proxy in front of it (Cloudflare): the proxy holds the TLS connection, absorbs attacks (DDoS), filters requests and can cache answers. The direct one reaches the platform’s own edge with nothing in between, for what the proxy cannot carry.

SSH is always direct.

The proxy’s limits

For a larger upload, a request that runs longer without sending anything, or a protocol other than HTTP, use the direct name; or upload in parts, answer 202 at once and let the client ask again, or send something at least every 100 seconds on a long answer.

Answers of Cubes and of your own domains are cached by the proxy as their Cache-Control says. A sandbox link’s answers are not cached, unless the sandbox’s own answer sets Cloudflare-CDN-Cache-Control.

Direct names

• A Cube gets its direct name with direct: true (POST /v1/apps or PATCH /v1/apps/{app}); its answer then has direct_url, and false takes it away. An app that did not ask has only its proxied address.
• A sandbox’s link always has a direct form: put the link’s first part under direct.glac.run. Nothing has to be set.
• A direct name has none of the proxy’s protection: only the edge’s own limits keep it, at most 500 connections at once from one visitor’s address (an IPv6 /64 counts as one; past it, 429 too_many_connections), 1 000 to one sandbox or Cube, and 6 000 to one edge.

Your own domain

POST /v1/domains with {domain, app} takes proxied too (true unless you say), and PATCH /v1/domains/{id} changes it.

• Proxied: point a CNAME from your name to <token>.glac.run. The proxy proves the name and issues its certificate, renewed for you. The answer’s proxy says where it stands: waiting, full (waiting for a place), pending (the name is being proven and the certificate issued), active, or failed with the proxy’s own words; proxy.records lists records you can add to have the certificate before you point the name.
• Direct: point a CNAME to <token>.direct.glac.run, or the A and AAAA records the answer gives together with its TXT proof; the edge issues a certificate from Let’s Encrypt and renews it. A new name’s certificate, a renewed one and a deleted name take effect at the next TLS handshake on every edge, and nothing else is restarted for them.
• A name at the top of a domain (example.com) cannot be proxied with A records: proxy it only if your DNS can flatten a CNAME there (ALIAS, ANAME); otherwise register it with proxied: false.
• Changing proxied changes the way to your Cube: the certificate is the new way’s, so the domain goes back to waiting for it.
• Whether requests take the proxy is decided by your DNS: a name pointed at the direct target is served direct.