External URLs

When a Worker, Container, or Daemon declares a named public endpoint, Alien creates an HTTPS endpoint for that resource endpoint. Containers can also declare TCP endpoints for non-HTTP protocols (see TCP Endpoints).

Endpoints are internet-facing by default. For AWS managed Containers, the customer can choose Only my network during setup to keep every Container endpoint inside their network.

Endpoint accessCopy Anchor Link

.publicEndpoint(...) declares an endpoint reachable outside the deployment. The deployment setting endpointAccess chooses who can reach it:

• internet (default): internet-facing load balancers.
• private: internal AWS load balancers, reachable from the VPC and networks connected through peering or VPN routing.

Choose this once during setup in the portal, with the CloudFormation EndpointAccess parameter, or with the Terraform endpoint_access variable. Developers can set the default through existing setup-link stack settings. Changing it later requires a new deployment.

Private access works best with Use existing network, in the VPC where the calling apps run. Internal load balancers use private subnets when available, or public subnets in a default VPC. Their DNS names resolve to private IP addresses, including from outside the VPC; the hostname and HTTPS certificate stay the same, but an internet client cannot connect. Network routing controls access, with no additional source filtering inside routable networks.

Private access currently supports HTTP and TCP endpoints on AWS managed Containers. GCP, Azure, Kubernetes, machines, Worker and Daemon endpoints do not support this setting. A private DNS name alone does not make an internet-facing endpoint private.

See Networking for network selection.

Declaring EndpointsCopy Anchor Link

Workers, Containers, and Daemons declare endpoints with .publicEndpoint(). Workers take a name only; Containers and Daemons also take the port to expose:

const api = new alien.Worker("api")
  .code({ type: "source", src: "./api", toolchain: { type: "typescript" } })
  .publicEndpoint("api")
  .build()

const web = new alien.Container("web")
  .code({ type: "image", image: "ghcr.io/acme/web:v1" })
  .publicEndpoint("web", 8080, "http")
  .build()

const agent = new alien.Daemon("agent")
  .code({ type: "image", image: "ghcr.io/acme/agent:v1" })
  .publicEndpoint("api", 8080, "http")
  .build()

Endpoint names must be lowercase DNS labels (letters, digits, hyphens).

HostnamesCopy Anchor Link

Each deployment gets its own domain, and every endpoint becomes a hostname on it. By default the endpoint name is the host label — an endpoint named api is served at api.<deployment-domain>. Options control the hostname:

.publicEndpoint("api", 8080, { protocol: "http", hostLabel: "@" })
.publicEndpoint("tenants", 8080, {
  protocol: "http",
  hostLabel: "tenants",
  wildcardSubdomains: true,
})

TCP EndpointsCopy Anchor Link

Declare an endpoint with protocol "tcp" to expose a non-HTTP protocol — a database wire protocol, a message broker, a custom binary protocol:

const postgres = new alien.Container("postgres")
  .code({ type: "image", image: "postgres:16" })
  .publicEndpoint("pg", 5432, "tcp")
  .build()

TCP endpoints route through a network load balancer instead of an HTTP front door. Traffic passes through to the container — Alien does not terminate TLS, so the workload owns its own protocol and encryption. The endpoint still gets a hostname on the deployment domain, and clients connect to it on the declared port.

During rollouts and deletes, replicas are removed from the load balancer before they stop, and existing connections drain within the workload's stopGracePeriod.

What Gets CreatedCopy Anchor Link

Each platform sets up the endpoint differently:

TLSCopy Anchor Link

Because every deployment runs in a different cloud account, there is no shared certificate. Alien issues a TLS certificate per deployment and imports it into the customer's cloud — ACM on AWS, Certificate Manager on GCP, Key Vault on Azure — then renews and re-imports it automatically. The certificate lives in the customer's account, where the load balancer references it.

Customers who need to manage their own certificates can bring their own domain and certificate reference instead (see Custom Domains); Alien never sees the private key.

Getting the URLCopy Anchor Link

Resource outputs include publicEndpoints, keyed by endpoint name:

From the manager API:

GET /v1/deployments/:id/info

Returns the resolved endpoint URLs per resource, so your control plane reads them instead of constructing them.

Use CasesCopy Anchor Link

• AI APIs — expose an inference endpoint in the customer's cloud that your control plane calls
• Webhooks — receive callbacks from third-party services (Stripe, GitHub, Slack)
• Internal tools — customer employees access dashboards or admin interfaces
• Microservices — other services in the customer's environment call your Worker over HTTP

Custom DomainsCopy Anchor Link

Customers can use their own domain and TLS certificate instead of the auto-generated cloud URL. This is configured per-deployment via stack settings:

{
  "domains": {
    "customDomains": {
      "api": {
        "domain": "api.corp.megacorp.internal",
        "certificate": {
          "aws": { "certificateArn": "arn:aws:acm:us-east-1:..." }
        }
      }
    }
  }
}

Platform-specific certificate references:

Alien handles certificate import and load balancer configuration. The customer manages DNS.