Guide

Networking

Private networking

Services in the same environment reach each other over a private network, with no public exposure. Databases from templates are only reachable this way.

Internal hostnames

Each service has a hostname derived from its name, under mesh.internal:

Service nameHostnameShort name
apiapi.mesh.internalapi
Postgrespostgres.mesh.internalpostgres
API Serverapi-server.mesh.internalapi-server

Both names resolve to every replica's IPv4 and IPv6 address, so an app that listens on 0.0.0.0 or :: is reachable. Connect on the port the app listens on; private traffic needs no domain and no port mapping.

Terminal
DATABASE_URL=postgresql://app:<password>@postgres.mesh.internal:5432/app
API_URL=http://api.mesh.internal:8080

Addresses stay the same across restarts and while a serverless service sleeps.

Isolation

  • One network per environment. staging services cannot reach production services, even in the same project. Your app does not need to enforce this.
  • Encrypted. Private traffic is encrypted in transit.

Public traffic

Private networking is for traffic between your services. To accept requests from the internet, add a domain. Outbound internet access works from every service and is metered as public egress. See Metrics and usage.