networking & urls

every machine gets a live HTTPS URL. repoint it, publish extra ports, attach your own domain, wire machines together privately.

your machine's URLs

each machine is reachable at https://<machine>.<handle>.<content-domain>: machine name, your handle, the platform's content domain. handle alice, machine app: https://app.alice.ironwire.xyz.

the main URL is served on the standard HTTPS port (443) and forwards to one port inside your machine, 8000 by default. run a web server on that port and it is live. TLS is handled for you.

check the current port setup (main URL and published ports) any time:

$ ssh dashboard@ironwire.sh ports app
443:  https://app.alice.ironwire.xyz → vm port 8000
published: (none)

$ ironwire ports app
443:  https://app.alice.ironwire.xyz → vm port 8000
published: (none)

changing the fronted port

point the main URL at a different port with ports <name> main <guest-port>. applies live, no restart. set it to none to turn the main URL off entirely (the URL then reads unreachable rather than serving an empty page).

$ ssh dashboard@ironwire.sh ports app main 3000
443:  https://app.alice.ironwire.xyz → vm port 3000
published: (none)

$ ironwire ports app main 3000
443:  https://app.alice.ironwire.xyz → vm port 3000
published: (none)

create without a main URL from the start with create <name> --port=none, or pick the fronted port at creation with --port=<guest>.

publishing extra ports

<SCREENSHOT: ports editor (o in the dashboard) with the main URL row and one published mapping>

beyond the main URL, publish up to 5 extra HTTPS ports. each mapping exposes https://<machine>.<handle>.<content-domain>:<public> and forwards it into the machine. TLS handled here too. all port edits apply live.

$ ssh dashboard@ironwire.sh ports app add 9443:9000
443:  https://app.alice.ironwire.xyz → vm port 3000
published:
  https://app.alice.ironwire.xyz:9443 → vm port 9000

$ ironwire ports app add 9443:9000
443:  https://app.alice.ironwire.xyz → vm port 3000
published:
  https://app.alice.ironwire.xyz:9443 → vm port 9000

publish at creation time with repeatable --publish=<public>:<guest> flags. remove a mapping with its public port:

$ ssh dashboard@ironwire.sh ports app rm 9443
443:  https://app.alice.ironwire.xyz → vm port 3000
published: (none)

$ ironwire ports app rm 9443
443:  https://app.alice.ironwire.xyz → vm port 3000
published: (none)

both sides of a mapping must be in the range 1 to 65535. each public port can be used once per machine. a few public ports are reserved by the platform:

custom domains

serve a machine on a domain you own instead of (or alongside) its platform URL. it must be a subdomain like app.example.com, since an apex domain can't be a CNAME.

set the domain on the machine:

$ ssh dashboard@ironwire.sh domain app set app.example.com
custom domain app.example.com set for app (pending)
  create a CNAME:  app.example.com  →  app.alice.ironwire.xyz
  it goes live automatically once that resolves

$ ironwire domain app set app.example.com
custom domain app.example.com set for app (pending)
  create a CNAME:  app.example.com  →  app.alice.ironwire.xyz
  it goes live automatically once that resolves

then add a CNAME record at your DNS provider pointing your domain at the machine's platform hostname shown above. the CNAME itself is the ownership proof: no verification token to copy. the platform checks the record about once a minute and flips the domain to active as soon as the CNAME resolves. check where things stand any time:

$ ssh dashboard@ironwire.sh domain app status
custom domain: app.example.com (active)
  CNAME → app.alice.ironwire.xyz

$ ironwire domain app status
custom domain: app.example.com (active)
  CNAME → app.alice.ironwire.xyz

once active, a TLS certificate is issued for your domain and it serves everything the machine exposes: the main URL and any published ports. if the CNAME later stops resolving, the domain drops back to pending until it resolves again.

remove a custom domain:

$ ssh dashboard@ironwire.sh domain app rm
custom domain cleared for app

$ ironwire domain app rm
custom domain cleared for app

machine-to-machine networking

machines in the same account reach each other directly on their private IPs, on any port, without publishing anything. other accounts are blocked both ways: your machines cannot reach theirs, theirs cannot reach yours.

each machine gets a private 10.0.0.x address, shown in list and info. it is not reachable from the internet. inside the guest, the hostname is the machine's name, so machines are easy to tell apart from a shell.

$ ssh dashboard@ironwire.sh info app
...
ip: 10.0.0.2 — reachable by your other machines on any port; not reachable from the internet
...

SSH access

every machine has SSH login: open a shell with connect <name> from the console. see Connecting for details, Machines for the lifecycle, and the command reference for full ports and domain syntax.