Networking

Generated domains#

Any HTTP service can get a domain under skiffly.cloud with a certificate already issued:

Domains are per environment: the same service has different domains in production and staging. Generating twice returns the existing domain. Each domain points at the port the service listens on; the first domain is exposed to the container as SKIFFLY_PUBLIC_DOMAIN.

Custom domains#

1. Add the domain: Settings → Networking → Add custom domain, skiffly domain app.example.com or customDomainCreate.

2. Create the two DNS records Skiffly prints:

   app.example.com.            CNAME  edge.skiffly.cloud.
   _skiffly.app.example.com.   TXT    "<verification token>"

   Apex domains (example.com) need a provider that supports ALIAS/ANAME or CNAME flattening.

3. Verify: skiffly domain status app.example.com or customDomainVerify(id). Once the TXT record resolves, the domain is routed and a Let's Encrypt certificate is issued, usually within a minute. No redeploy is needed.

skiffly domain app.example.com
skiffly domain status app.example.com     # prints the records and the verification state
skiffly domain delete app.example.com

Every domain is served on both http:// and https://; there is no forced redirect yet, so redirect in the app if you need it (X-Forwarded-Proto is set). Wildcard custom domains are not supported.

Private networking#

Services in the same project and environment share a private network. Each service is reachable at its slug (the lowercase service name; SKIFFLY_PRIVATE_DOMAIN) on its port, no domain needed:

http://api:8080
postgres://postgres:…@postgres:5432/app
redis://redis:6379

• The private hostname works only inside the environment; production cannot reach staging.
• Traffic between projects is denied by network policy; the internet is reachable outbound, except port 25.
• Databases from templates listen on the private network only. ${{Postgres.DATABASE_URL}} already uses the private hostname.
• Private hostnames resolve to the service's replicas; the port is the service's port, not PORT of the caller.

TCP proxies#

Non-HTTP services (Postgres, MySQL, Redis, Mongo, a game server) can be exposed on a public host:port:

skiffly connect postgres          # creates a proxy after confirmation and opens psql
skiffly proxy add --port 5432     # edge.skiffly.cloud:2xxxx → container port 5432
skiffly proxy list
skiffly proxy delete 21543

The proxy is edge.skiffly.cloud:<port> with a unique port in 20000–29999, applied to a running service immediately (syncStatus: ACTIVE; CREATING until the first deployment). Traffic goes straight to the container without TLS, so the service must require a password. Up to five proxies per service and environment. A service with a TCP proxy cannot use App Sleeping.

Not yet#

Static outbound IPs, a CDN/WAF layer, wildcard custom domains and email forwarding do not exist. Outbound traffic leaves from the node's IP.