Networking, domains & security

API gateway

Gateway rules are named Traefik middleware bundles attached to a project or sandbox route:

Rate limit — average requests per second plus a burst allowance.
Circuit breaker — stop forwarding to an unhealthy upstream.
Security headers — HSTS, frame options and related headers.

A rule takes effect while it exists; removing it disables the behaviour.

Firewall & WAF

Allowlist — CIDRs allowed through. When set, every other source is denied

at the edge.

Blocklist — CIDRs denied; sources receive 403 from the edge.
WAF — Coraza with the OWASP Core Rule Set for layer-7 filtering.

Private networks

Projects can be attached to a private network so their services reach each other over an internal address space with no public ingress. Isolation is per organization by default.

Custom domains

Attach a hostname to an app or an edge function and publish the DNS records the platform issues:

Type	Name	Value
`CNAME`	`api.acme.com`	`app.tngat.com`
`TXT`	`_tngatc-verify.api.acme.com`	the value shown in the console

Verification is a DNS lookup, so it can be re-run at any time. Certificates are issued by Let's Encrypt per hostname once verification passes.

Wildcard DNS is required for deployed apps: point *.app.tngat.com at the platform edge. Literal per-app records are not needed.