Public and private apps

Every Plexivo App Runner app is public or private. A public app has its HTTPS address and your custom domains. A private app has no internet address at all: only your own services can reach it. Use private apps for internal APIs, workers and admin tools.

Who can reach an app#

Your organisation’s other services are its other Plexivo App Runner apps and its Plexivo Kubernetes workloads. Nothing from another organisation can open a connection to your apps except through their public address.

Make an app private#

1. Open the app’s Settings tab. In Network access, choose Private.
2. Apply. Choose Apply changes. Plexivo removes the public address and stops serving the app’s custom domains.

Choose Public again at any time and its address and verified domains come back. A private app cannot have a custom domain added.

Choose who may call it#

By default every service in your organisation may call the app. To narrow that, tick the apps under Allowed callers. Then only those Plexivo App Runner apps may connect. This works for public and private apps alike, and the list can hold up to 50 apps.

curl -s -X PUT $API/deployments/$APP/network \
  -H "Authorization: Bearer $PLEXIVO_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"visibility": "private", "allowed_callers": ["CALLER_APP_ID"]}'
# {"network": {"visibility": "private", "allowed_callers": ["…"]}}

Send an empty allowed_callers list to allow every service in your organisation again.

What your apps can reach#

Apps can reach the public internet and your organisation’s own databases, caches and services, as each one’s own network access allows. Other customers’ workloads and Plexivo’s internal networks are never reachable.

Protection for public apps#

Every public app is protected by Plexivo Shield: a request rate limit, a request size limit, and IP allow and deny lists at the edge.

Next steps#