Networking and reachability

Two directions that are easy to confuse. Inbound means someone on the internet can call your application. Outbound means your application calls something external: a payment API, a mail service, another system. You configure both under Netzwerk & Exposure in the portal, and both are closed by default.

Closed by default is deliberate. An application that is accidentally open is the most common way an environment gets compromised.

Making an application reachable

1. Create the namespace and get your application running in it.
2. Open Netzwerk & Exposure and check which hostnames your account may use.
3. Enter the publication you want.
4. Copy the values the portal shows you into your manifests unchanged.
5. After the change is applied, check that the route actually answers.

Step four is where this most often goes wrong: do not guess names. Certificate issuers, TLS secret names and permitted hostnames are all shown in the portal, and a plausible-sounding value you invented yourself produces a route that simply never arrives.

The TLS certificate is handled by the platform. You do not have to request or renew anything.

Your own domain

Using your own domain requires proof that it is yours. The portal shows you the DNS records to set at your domain provider, and then the validation status.

Wait for that status before promising the hostname to anyone. A DNS record on its own does not mean the route is ready, and _acme-challenge values should be neither invented nor copied from somewhere else.

What your application may reach

Outbound connections are limited to the destinations enabled for your account. If your application needs one that is not there, ask for it and name the specific host and the reason.

Resist the urge to allow everything. Network rules are one of the few mechanisms still working when something inside your application goes wrong: a compromised dependency that cannot phone anywhere does considerably less damage.

When it does not work