PRIVATE SERVICES & NETWORKING
Public where it should be. Private everywhere else.
Every application has an explicit exposure choice. Public applications get an HTTPS address; private applications get an internal address and nothing more. Connections between them are directed, explicit, and limited to the port the service declares.
atlas · atlas.ideployed.app
One direction. Explicitly granted.
atlas is public: it has an HTTPS address, a managed certificate, and a route on the internet.
You connected web → redis on port 6379
Other applications can’t reach atlas just because they exist on the platform.
- STEP 01
Choose the exposure
Public gives you an HTTPS address with a managed certificate. Private gives you an internal address — no public route, no certificate.
- STEP 02
Connect explicitly
Within the same project, you connect application A to private application B, on B’s declared port. The direction is yours to choose.
- STEP 03
Everything else stays out
An application does not gain access to every other service just because it exists on the platform. No connection means no route.
WHAT PUBLIC MEANS
Web traffic, with TLS handled.
Public exposure means web traffic. Your application receives a platform HTTPS address on ideployed.app, or you connect your own domain, follow the DNS instructions, and watch verification progress. Managed certificates handle the lifecycle from there.
It is not a promise of arbitrary public TCP or database endpoints — private service addresses are not public websites.
WHAT PRIVATE MEANS
An internal address. Nothing more.
Private applications live inside your project’s network: reachable from the applications you connect to them, invisible to everything else. The classic shape is a public web app connected to its private Redis — one direction, one port, explicitly granted.
# from the atlas web app
REDIS_URL=redis://atlas-redis.internal:6379
# reachable because you connected atlas → atlas-redis:6379
ENFORCED BY THE PLATFORM
The backend owns authorization. You own the intent.
Restricted connection policies are written and enforced by the platform’s own controllers — the desired connection state lives in the backend, not in policy files you maintain. You declare which application may reach which service; the platform makes it so, and keeps everything else out.
Directed
Connections have a direction: A may reach B. That does not imply B may reach A.
Scoped
Connections live within a project — not across your whole account, let alone the platform.
Port-specific
Access is limited to the service’s declared port, not its whole network identity.
KEEP EXPLORING
YOUR NEXT CHAPTER
Good ideas deserve
to be out there.
Bring your code. Make something people can use.