Private networking, proxy, IPs & certs

Each account has a private network. Your other apps reach every app and worker as <app>.internal, on any port. Other accounts' apps are on separate networks and can't reach yours. Managed Postgres is reachable the same way (see Postgres).

aloof proxy 5432 -a my-db-app        # localhost:5432 -> instance:5432 over an authenticated WebSocket
aloof proxy 8081:9000 -a my-app      # local 8081 -> private port 9000
aloof ips -a my-app                  # shared public edge IPv4/IPv6 + private addresses
aloof certs -a my-app                # Let's Encrypt status/expiry for <app>.domain + custom domains

Limits: .internal resolves between apps on the same host. Apps placed on different remote nodes don't share a network yet. On remote nodes, proxy reaches only the app's internal_port. Public IPs are the shared edge; dedicated and anycast IPs aren't offered.