Networking

Beyond public domains and the per-request rules in Edge rules, apps also need to talk to each other privately, and sometimes to sit behind a third-party CDN or get one certificate for a whole wildcard domain. This page covers those three.

Private networking between apps

Every app gets a private name, <name>.railyard.internal, instead of apps having to find each other by public IP:

• Same server: the name is a Docker network alias, so it resolves straight to the container on the app’s own port (container_port). This needs no setup.
• Different server, private network off: a reference to the other app still works, it just isn’t private — it resolves to that app’s normal public https:// address instead of failing.
• Different server, private network on: turn it on from Servers → Private network → Turn on (admins). Every server of the team joins an encrypted WireGuard network (10.210.0.0/16), and <name>.railyard.internal then resolves, from any server of the team, to wherever the app actually runs — over the mesh, to its published port. The canvas draws such a link as private. Containers already running pick up the new resolver on their next deploy or restart.

Reference another service with ${{api.RAILYARD_PRIVATE_URL}} (for an app named api) instead of hardcoding a host — see Variables and secrets. It expands to whichever of the cases above applies, so the same reference keeps working if the two apps later end up on different servers.

More public ports

Settings → General → More public ports takes one name:port per line (e.g. metrics:9100) for a second protocol or admin interface on the same app. Each gets its own HTTPS address — <name>-<app-hostname> — routed and certified the same way as the app’s main address.

Cloudflare in front of an app

Settings → Networking → Cloudflare puts Cloudflare’s CDN, DDoS protection and WAF in front of an app’s own platform address, when that address’s DNS is already on Railyard’s managed DNS and that DNS runs on Cloudflare (not Route 53, and not a custom domain Railyard doesn’t hold the zone for — the card explains which case applies).

• Turning it on proxies the DNS record the next time Railyard writes it — the next deploy or a failover, not instantly.
• The edge proxy trusts Cloudflare’s published IP ranges and reads the real visitor’s IP from CF-Connecting-IP, so rate limiting, country blocking, the WAF and access logs keep seeing the actual visitor instead of Cloudflare’s edge once an app turns this on — see Edge rules.
• HTTPS keeps working: Railyard’s own Let’s Encrypt certificate is still issued and served at the origin. Set Cloudflare’s SSL mode to Full (strict), which checks that certificate instead of trusting whatever the origin presents.
• You still have to point this domain’s nameservers at Cloudflare yourself — Railyard only ever writes the one DNS record it already manages, never a zone’s nameservers.

Wildcard certificates through DNS-01

A wildcard domain (*.example.com, see Domains) defaults to on-demand TLS: each subdomain gets its own Let’s Encrypt certificate the first time someone visits it, so 20 subdomains means 20 certificates. For one certificate covering the whole wildcard instead:

1. Team settings → DNS credentials → add a Cloudflare API token (scoped to Zone:DNS:Edit for the zone, not the global API key) or a Route 53 access key (route53:ChangeResourceRecordSets and route53:ListResourceRecordSets on the hosted zone). Stored encrypted, used only for the DNS-01 challenge.
2. On the app’s Domains tab, adding or editing a wildcard address shows a DNS credential dropdown. Pick one to request a single wildcard certificate; leave it blank to keep the on-demand behavior.

Removing a credential falls its wildcard domains back to on-demand certificates instead of breaking them.

Outbound traffic

An app’s outbound connections leave from its own server’s public IP — there’s no shared NAT pool, and no extra charge for a stable address to hand a third-party API’s IP allowlist, the way a multi-tenant platform needs one. The IP only changes if the app itself moves to another server.

See also

• Domains — the default address, custom domains and the ownership check.
• Edge rules — per-request rules: redirects, headers, CORS, rate limiting, country blocking, the WAF.
• Variables and secrets — referencing another service’s private URL.
• Add a server — turning on the private network.