Private networking

With the private network on, your team's other apps reach an app at http://<app>, without the public internet. A frontend can call its API, and an API can call an internal service, and none of it is exposed to the world.

Turn it on

It is off by default and set per app, on the app that receives the calls:

the app's Settings tab, under Private network;
the CLI: deplane config --private-network on (and off);
the API: private_network in the app's settings.

deplane config shows the setting, and the private address when it is on. Turning it off takes effect within seconds.

Use it

Other apps of your team call the app by its name, over plain HTTP on port 80. Deplane sends the call to the port the app listens on, so the port in deplane.toml does not appear in the address:

$ deplane config --private-network on --app api
Private network is on for api: your team's other apps reach it at http://api.

$ deplane secrets set API_URL=http://api --app web

Calls inside Deplane are not encrypted, which is why they never leave it. Use https:// with the public address for anything that goes through the internet.

Who can reach it

Your team's other apps, and their workers, cron jobs, release commands and runs.
The app's own workers, cron jobs, release commands and runs, always, even with the private network off.
Not pull request previews. A preview can neither reach an app privately nor be reached, so a pull request never talks to production. The setting cannot be turned on for a preview.
Not apps of other teams, ever.

An app that has the private network off refuses private calls from other apps. Turning it on for one app does not open any other app. The calling app needs no setting.

Sleep

An app that sleeps when idle wakes only for public requests, so it cannot answer private calls. Turning the private network on is refused while sleep is on, and the other way around, with private_network_sleep. Turn sleep off first (deplane scale --sleep off), or turn the private network off. Autoscaling works with it.

Limits

Limit	Value
Apps in a team that use the private network	Teams with 2000 apps or more cannot turn it on: private_network_too_many.
Pull request previews	Never. preview_private_network
Protocol	HTTP on port 80, to the app's own port.

This page is also available as Markdown. AI agents can start at /llms.txt.