Concepts
Architecture
The two independent planes that share one database and talk over HTTP.
Applications
An application represents one product surface in your account (tenant). It
holds the record template new connections inherit, the allowed origins
for widget embedding, and its environment (test/live). API keys and delegated
DNS credentials belong to an application.
The two planes
- Connect plane (the control-plane) — the REST API, ownership verification, DNS auto-write, quotas, webhooks, and background workers.
- Edge plane — on-demand TLS termination + reverse proxy, gated by a single
internal
askcall to the control-plane.
The edge hot path
GET /internal/ask?domain=<host> is the only call the edge makes into the
control-plane. It answers from an O(1) covering index — no quota, no joins — so
the TLS handshake never blocks on business logic. Quota and billing are enforced
only on the control-plane write path.
See Connections for the data model and Self-hosting for how to run both planes.