A private staging site
Your staging site is behind a PIN from the first deploy, so you can review changes before anyone else sees them.
All six parts of Forge
Portcullis · Edge
The front door, and the only door
Portcullis is how visitors reach a site on Forge. Our cluster opens no web ports to the internet; it dials out to our edge over encrypted tunnels, and every name says who is allowed through.
Built on Pangolin, Traefik and WireGuard, with bunny.net in front
Why it matters
Most break-ins start at an open door. A server that accepts connections from anywhere has to be right about every one of them.
Portcullis turns that around. The cluster makes the connection out to our edge, so there is nothing on the inside for the internet to knock on, and each site states in a file whether it is public, behind a PIN or private.
- inbound web ports on the cluster
- 0
- dial-out tunnels, from separate machines
- 2
- sites served through the bunny.net CDN
- 4
- access levels in use - public, PIN, internal
- 3
How it works
Dial out, not in
Two machines in the cluster each keep an encrypted WireGuard tunnel open to our edge server. Visitors arrive at the edge; their requests travel down the tunnel.
Every name says who may enter
Each address declares one access level - public, behind a PIN, or internal to our own network. A new staging site defaults to the PIN, so nothing is public by accident.
Cached close to your visitors
Public websites can sit behind bunny.net, a content delivery network, so pages load quickly wherever your visitors are. The CDN settings are written from the same naming files and applied by pipeline.
Watched from outside
A separate prober, outside our network, checks the public sites and the tunnel and alerts us when something fails.
Live today
- No inbound web ports; sites are reached through dial-out tunnels.
- Public, PIN-protected and internal access levels.
- bunny.net in front of four websites, including this one.
- External checks on public sites, with alerts.
In progress
- Sign-in-protected access, for tools that should need an account rather than a PIN.
- Tightening access to the edge's own dashboard and management, part of our zero-trust work.
What you get
A fast public site
Production can be served through the CDN, with HTTPS on your own domain.
A smaller target
Your application is never directly on the internet; only the edge is.
Built on
Pangolin
A tunnelled reverse proxy: the control plane that decides which tunnel and which service a request goes to.
Traefik
The open-source proxy that routes each request and terminates HTTPS at the edge.
WireGuard
The fast, modern encrypted tunnel between our cluster and the edge, via Pangolin's Gerbil.
bunny.net
A European content delivery network. A commercial service, not open source - and we say so.
Related parts
Hallmark
A standard name for every service, so nothing on the platform is a mystery. Every name is checked automatically before it exists.
Keystone
How our services find each other, and how browsers and services know they are really talking to us.
Flash
One "Sign in with Forge" account across the apps you use with us, defined as code. In testing now.