Networking
How requests reach your app
TLS, routing, headers and limits between the client and your code.
Every request to an app passes through Teral's edge, Frontline, before it reaches an instance.
- TLS. Frontline terminates HTTPS with TLS 1.2 or newer. Plain HTTP requests are redirected to HTTPS.
- Routing. Frontline looks up which deployment the hostname belongs to. Hostnames that belong to no deployment get a
config_not_founderror. - Policies. The gateway applies the environment's policies. A request a policy blocks never reaches your app.
- Forwarding. Frontline picks a healthy instance at random and forwards the request over the upstream protocol you chose.
If something along the way fails, Frontline answers with an error instead of your app.
Headers your app receives
| Header | Value |
|---|---|
Host | The hostname the client asked for. |
X-Forwarded-For | The client's IP address. |
X-Forwarded-Host | The hostname the client asked for. |
X-Forwarded-Proto | https, or http if the client used plain HTTP. |
X-Teral-Request-Id | An ID for the request. Log it: support can trace a request by it. |
X-Teral-Region | The region that handled the request. |
X-Teral-Frontline-Id | The Frontline instance that handled the request. |
Teral overwrites these headers, so a client can't fake them.
Headers Teral adds to responses
| Header | Value |
|---|---|
X-Teral-Request-Id | The request's ID, which is useful when you report a problem. |
X-Teral-License | AGPL-3.0; Teral is a modified version of Unkey. Teral's gateway is open source software under the AGPLv3. |
X-Teral-Source | A link to the source code of the gateway version that handled the request. |
The license and source headers are on every response, from your app or from the gateway itself, such as an error page. Teral replaces any value your app sets for them. See License and source code.
Limits
- Request duration: a request that takes longer than 15 minutes is cut off with a
request_timeouterror. - WebSockets work without any setup. The 15-minute limit doesn't apply to them. Use
wss://, and send pings if a connection can be idle for long, since your own server's idle timeouts still apply. - Instance-to-instance traffic: instances can only be reached through Frontline. There's no private network between apps yet.