Network /
Networking on Northflank
Northflank allows flexible and secure private and public networking for services, jobs, databases and other addons. HTTP, HTTP/2, Websockets, gRPC, TCP and UDP are all supported networking protocols.
Networking settings are accessed on the ports & DNS page on deployment and combined services, and on the settings page in the network section for databases and other addons.
Public networking
HTTP, HTTP/2, Websockets and gRPC can be exposed publicly via a load-balancer served with an auto-generated TLS certificate with either code.run
endpoints or your own custom domains. HTTPS requests are terminated at the edge load-balancer and the request is routed via Northflank’s network.
You can choose to publicly expose databases and other addons via a load-balanced TCP endpoint. Northflank will enforce and generate TLS certificates which will be automatically configured in the database and connection details.
Northflank will expose your HTTP ports publicly on ports 80 and 443 and route traffic to your configured ports. HTTP (port 80) traffic is automatically redirected to HTTPS (port 443).
Private networking
Ports serving all protocols can be configured for private networking. Services, jobs and databases with private ports will only be accessible by other resources inside the same project.
Deployments and databases can be forwarded for secure, local access, without the need to publicly expose them to the internet.
You can also enable multi-project networking to securely access resources from another Northflank project.
Load-balancer
Northflank uses scalable and highly performant load balancers to securely distribute external traffic to containers in your projects. Traffic is routed to your application containers at the specified port configured. Every public port is assigned a Northflank code.run
domain, optionally you can add custom domains, disable code.run
traffic, and add IP policies and basic authentication security.
If you have multiple instances of a service running, ingress traffic will be directed with a round-robin load-balancing strategy. The load balancer will not route traffic to non-ready containers, for example containers that are starting, terminating, or that are failing health checks.
Certificates
Northflank uses Let's Encrypt to provision TLS certificates on-demand, generated by Let's Encrypt. Certificates are created automatically and renewed before they expire, with 2048-bit RSA encryption.
Your custom domains can be linked to a service port and immediately start serving secure traffic with a managed Let's Encrypt certificate.
Let's Encrypt imposes rate limits . Please keep these limits in mind when adding or removing subdomains, and generating Let's Encrypt certificates via other channels.
You can reduce the number of certificates you need to generate by configuring a domain to use wildcard certificates. Wildcard certificates allow your subdomains to share a certificate, and are ideal for dynamically generating subdomains in Northflank templates and preview environments.
Headers
You can access the source IP of a request from the X-Forwarded-For header , which is attached to all HTTP/S requests by the Northflank load balancer.
Next steps
Add public ports
Configure ports to expose your services on the internet.
Add private ports
Configure ports to allow your services to communicate securely within your project.
Expose ports in your application
Expose ports in your application to make it available for networking.
Set IP policies
Allow or deny access to services based on IP addresses.
Configure basic authentication
Require users to enter a username or password to access your site.
Expose a database with TLS
Secure internal database connections or expose it publicly with TLS.
Multi-project networking
Configure projects to securely allow ingress network traffic from other projects.
Forward deployments and databases
Forward deployments and databases to your local machine for development.
Domains on Northflank
Manage your domains on Northflank, quickly and easily assigning them to your deployments.
Use a CDN
Configure your subdomains to use a CDN to serve static content.
Use Tailscale
Allow secure access to Tailscale devices to resources within your project.