Эта страница ещё не переведена на язык «русский»: вот она на английском.
Every public address of a Cube and of a sandbox’s link has two forms. The proxied one, which you get unless you ask otherwise, reaches the platform through a proxy in front of it (Cloudflare): the proxy holds the TLS connection, absorbs attacks (DDoS), filters requests and can cache answers. The direct one reaches the platform’s own edge with nothing in between, for what the proxy cannot carry.
| Proxied | Direct | |
|---|---|---|
| A Cube | https://<app>-<project>.glac.run |
https://<app>-<project>.direct.glac.run, when the app asks for it (below) |
| A sandbox’s link to a port | https://<port>-<sandbox id>-<signature>.glac.run |
The same first part under direct.glac.run: https://<port>-<sandbox id>-<signature>.direct.glac.run |
| Your own domain | Registered with proxied: true (the default): a CNAME to <token>.glac.run |
Registered with proxied: false: a CNAME to <token>.direct.glac.run, or A and AAAA records to the edge’s addresses |
SSH is always direct.
The proxy’s limits
| Limit | When it is reached | |
|---|---|---|
| A request’s body | 100 MB | 413, and the request does not reach your app |
| An answer | 125 seconds between two pieces of it | 524 |
| Protocols | HTTP and HTTPS only | No connection |
| WebSockets | Carried, but the proxy closes them when it updates itself | Reconnect, with a heartbeat |
| gRPC | Not through the proxy yet | Use the direct name |
For a larger upload, a request that runs longer without sending anything, or a protocol other than HTTP, use the direct name; or upload in parts, answer 202 at once and let the client ask again, or send something at least every 100 seconds on a long answer.
Answers of Cubes and of your own domains are cached by the proxy as their Cache-Control says. A sandbox link’s answers are not cached, unless the sandbox’s own answer sets Cloudflare-CDN-Cache-Control.
Direct names
- A Cube gets its direct name with
direct: true(POST /v1/appsorPATCH /v1/apps/{app}); its answer then hasdirect_url, andfalsetakes it away. An app that did not ask has only its proxied address. - A sandbox’s link always has a direct form: put the link’s first part under
direct.glac.run. Nothing has to be set. - A direct name has none of the proxy’s protection: only the edge’s own limits keep it, at most 500 connections at once from one visitor’s address (an IPv6 /64 counts as one; past it, 429
too_many_connections), 1 000 to one sandbox or Cube, and 6 000 to one edge.
Your own domain
POST /v1/domains with {domain, app} takes proxied too (true unless you say), and PATCH /v1/domains/{id} changes it.
- Proxied: point a CNAME from your name to
<token>.glac.run. The proxy proves the name and issues its certificate, renewed for you. The answer’sproxysays where it stands:waiting,full(waiting for a place),pending(the name is being proven and the certificate issued),active, orfailedwith the proxy’s own words;proxy.recordslists records you can add to have the certificate before you point the name. - Direct: point a CNAME to
<token>.direct.glac.run, or the A and AAAA records the answer gives together with its TXT proof; the edge issues a certificate from Let’s Encrypt and renews it. A new name’s certificate, a renewed one and a deleted name take effect at the next TLS handshake on every edge, and nothing else is restarted for them. - A name at the top of a domain (
example.com) cannot be proxied with A records: proxy it only if your DNS can flatten a CNAME there (ALIAS, ANAME); otherwise register it withproxied: false. - Changing
proxiedchanges the way to your Cube: the certificate is the new way’s, so the domain goes back to waiting for it. - Whether requests take the proxy is decided by your DNS: a name pointed at the direct target is served direct.