You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
description: Defang helps you safely configure your services' networking.
4
4
sidebar_position: 300
5
5
---
@@ -8,70 +8,18 @@ import TabItem from '@theme/TabItem';
8
8
9
9
# Networking
10
10
11
-
Defang configures Security Groups, deploys applications to a private subnet and uses an Application Load Balancer to route traffic to your services from the public internet only when required.
11
+
By default, Defang configures your application's networking and security groups to follow secure best practices.
12
+
We also configure load-balancers and public IP addresses when appropriate. The following sections describe how to configure different network and security group topologies.
12
13
13
14
:::tip
14
-
This page is about internal networking only. If you want to configure your services to be accessible from the public internet, check the [Domains page](./domains.mdx).
15
+
This page is about complex networking. If you want to configure your services to be accessible from the public internet, check the [Domains page](./domains.mdx).
15
16
:::
16
17
17
-
## Internal Communication
18
+
## Networks
18
19
19
-
You can expose ports in your service definition to allow other services to communicate with it. Similar to public communication, you can use the `ports` section of your service definition. Set the `mode` to `host` (instead of the default `ingress`) to be able to connect to the container directly, avoiding the need of a load balancer.
20
+
The Compose spec has a notion of [networks](https://github.com/compose-spec/compose-spec/blob/main/06-networks.md). By default, each service gets added to the `default` network. Networks in Compose can be flagged as `internal`, but this means they have no connection to the outside world at all (no egress).
20
21
21
-
### Sample Configuration
22
-
23
-
<Tabs>
24
-
<TabItemvalue="compose"label="Compose"default>
25
-
```yaml
26
-
services:
27
-
# [...]
28
-
service1:
29
-
ports:
30
-
- mode: host
31
-
target: 3000
32
-
app_protocol: http
33
-
```
34
-
</TabItem>
35
-
<TabItem value="pulumi" label="Pulumi">
36
-
```typescript
37
-
const service = new defang.DefangService("service1", {
38
-
// [...]
39
-
ports: [{
40
-
target: 3000,
41
-
mode: "host",
42
-
protocol: "http",
43
-
}],
44
-
});
45
-
```
46
-
</TabItem>
47
-
</Tabs>
48
-
49
-
### Internal DNS
50
-
51
-
Internal communication is handled slightly differently between the Defang Playground and Defang BYOC.
Internal communication between services in the Defang Playground follows the following pattern:
56
-
57
-
```
58
-
http://<username>-<service-name>:<port>
59
-
```
60
-
</TabItem>
61
-
<TabItemvalue="byoc"label="BYOC">
62
-
Internal communication between services in Defang BYOC follows the following pattern:
63
-
64
-
```
65
-
http://<service-name>:<port>
66
-
```
67
-
</TabItem>
68
-
</Tabs>
69
-
70
-
### Networks
71
-
72
-
The Compose spec has a notion of [networks](https://github.com/compose-spec/compose-spec/blob/main/06-networks.md). By default, each service gets added to the `default` network. Networks in Compose can be flagged as `internal`, but this means they have no connection to the outside world at all (no egress).
73
-
74
-
Only services in the `default` network can have public IPs. Services in any other network will be in a private subnet.
22
+
Only services in the `default` network can have public IPs. Services in any other network will be in a private subnet.
75
23
76
24
```yaml
77
25
services:
@@ -97,4 +45,85 @@ networks:
97
45
internal: true # no egress
98
46
```
99
47
48
+
### Public Services
49
+
50
+
By default, services will be in the `default` network and behind a public load-balancer, ie. exposed ports default to `mode: ingress`:
51
+
52
+
```yaml
53
+
services:
54
+
web:
55
+
networks:
56
+
default: # this is the default, so no need to specify
57
+
ports:
58
+
- 80:80 # Defang will use a public load-Balancer
59
+
```
60
+
61
+
If you want a service to have a public IP address, ensure it's in the `default` network (the default) and
62
+
set the port to `mode: host`:
63
+
64
+
```yaml
65
+
services;
66
+
web:
67
+
ports:
68
+
- target: 80
69
+
mode: host # Defang will assign a public IP
70
+
```
100
71
72
+
### Private Services
73
+
If you want a service with exposed ports to not be accessible from the public internet, create a private network:
74
+
75
+
```yaml
76
+
services:
77
+
web: # this service can receive public traffic and communicate to private services
78
+
ports:
79
+
- 80
80
+
networks:
81
+
default:
82
+
private:
83
+
db: # this service can only receive traffic from other services in the same network
84
+
ports:
85
+
- 1234
86
+
networks:
87
+
private:
88
+
networks:
89
+
private: # any network that's not "default" is considered private
90
+
```
91
+
92
+
The service's hostname will be the same as the service's name, in this case `db`.
93
+
94
+
## Hostname Aliases
95
+
96
+
By using network aliases, a service can be made available at multiple hostnames.
97
+
98
+
```yaml
99
+
services:
100
+
web:
101
+
domainname: example.com
102
+
networks:
103
+
default:
104
+
aliases:
105
+
- www.example.com # a public alias
106
+
```
107
+
108
+
### Internal DNS
109
+
110
+
Internal communication is handled slightly differently between the Defang Playground and Defang BYOC.
0 commit comments