Routes
Routes
Section titled “Routes”A route is how traffic reaches a service. There are two kinds:
- A domain route is a hostname served over HTTPS, such as
app.example.com, for anything that speaks HTTP. - A TCP route is a port on the gateway, forwarded over the mesh as it is, for Postgres, Redis, SSH and anything else that does not.
A route can be paused, which stops it serving without deleting it.
A domain route lives in one of three zones of a base domain:
- Public:
app.example.com, on the internet. - Internal:
grafana.internal.example.com, answered only on your mesh. For tools and dashboards nobody outside should reach. Once the mesh policy is enforced, it answers only the machines whose owners may use what it leads to (see Users & access). - Preview:
app.preview.example.com, public, kept apart from your real names.
A TCP route binds the gateway’s public interfaces (subject to its allowlist and the host firewall), its mesh address only, or local loopback only, reached through an SSH tunnel to the gateway.
Targets
Section titled “Targets”A domain route sends each path to a target: a service’s port, an address on a node, or a redirect to another route. Several paths can go to different services, and strip path removes the path prefix before the request reaches the target.
Certificates
Section titled “Certificates”Certificates are automatic. A base domain whose DNS is delegated to the gateway gets one wildcard certificate that covers every name under it. A domain in on-demand mode gets a certificate per hostname the first time it is asked for. An internal route on an on-demand domain uses a certificate from the gateway’s own authority, which browsers on your machines need to trust once.
Your own hostnames
Section titled “Your own hostnames”A route can use a hostname outside your base domains, such as shop.customer.com. The simplest proof that it is yours is a CNAME from it to another address of the same project, such as the app’s own address: that one record proves the name and points it here. Otherwise the name is proved with a TXT record at _meshploy-verify.<hostname>, and pointed here with a CNAME to the gateway’s edge name, edge.<primary domain>, which follows the gateway if it ever moves to another machine. An A record to the gateway’s address works too, but pins the name to this machine. A bare domain cannot have a CNAME: use your provider’s flattening (ALIAS or ANAME) if it has one, or the A record. The route shows the records to add.
A whole hostname one label under a verified base domain, such as shop.example.com under example.com, is simply a route on that domain, and needs no proof, whichever way it was created. The TXT record of a proof is read once, so delete it after the route is verified; a route deleted and made again asks for a new one.
In environment levels
Section titled “In environment levels”A route in a level takes the level’s name: app in staging is served as app-staging. See Projects & environments.
- Internal zone: Names under internal.
, answered only on your mesh. More - Preview zone: Names under preview.
: public, and kept apart from your real names. More - Paused: Not serving, and not deleted. Publish it again to serve. More
- TCP route: A port on the gateway forwarded over the mesh as it is, for anything that does not speak HTTP. More
- Strip path: Removes the path prefix before the request reaches the target. More