Proxy to apps on different custom private networks

1

I have a Nginx reverse proxy app that passes on requests to apps over flycast. Something like:

location / {
  proxy_pass http://$service.flycast:1234;
  ...
}

Whilst this approach has worked well I am now exploring custom private networks to improve isolation of apps.

I can create new apps on their own network without issue but the proxy of course will no longer be able to pass the requests on to the apps on a different private network because the proxy sits in the default private network.

I only want the one proxy as it’s configured with dns.

What’s the best way (if any) to be able to pass requests on to the apps regardless of the network they sit in?

Thanks

2

Hi… The (admittedly non-obvious, :black_cat:) --network flag of fly ips allocate-v6 is made to do exactly that:

https://fly.io/docs/networking/custom-private-networks/#private-apps-with-flycast

Depending on the level of isolation you’re going for, you might want to put the Nginx proxy itself in a custom network.

(Otherwise, the name of the request-making network is just default, I believe.)

Hope this helps!

3

Added proxy

4

Hi
Not sure this would work. Requests come to the proxy for an app but it doesn’t know the network the app is in. It just needs to be able to forward the request to that app but as it’s in a separate network it can’t reach it.

I’m aware of the network field (and I’ve actually commented on another question about this) but this needs to be dynamic.

5

No, the Nginx proxy itself doesn’t need to know its network name; that’s only needed by you, personally, during early setup—right after the initial app create.

The Nginx proxy can just refer to app-name.flycast, like before:

https://community.fly.io/t/run-private-applications-with-flycast/20387/4

https://community.fly.io/t/run-private-applications-with-flycast/20387/7

One of the appeals of Flycast addresses is that they do allow controlled traffic across separate networks.

6

You can’t connect across networks without pre-configuration.

“Private apps on different 6PNs can’t communicate without being explicitly configured to do so.”

I don’t know the network that the app is in because it’s created dynamically.

7

Exactly, and that pre-configuration is fly ips allocate-v6 --private -a app-name. (Apparently, you don’t even need the --network flag, if you just want it to be accessible from the default network.)

Do this (or the corresponding GraphQL call) right after you create app-name, the target that you’re trying to forward things to.

Possibly I muddled the issue by suggesting that the Nginx proxy also be in a custom network!

8

I think you misunderstand me but thanks for trying to help.

9

This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.