Private networking

Services inside a project reach each other and their attached databases over a private network. That traffic never leaves Guidal's infrastructure and is not reachable from the public internet.

Private networking is available on every plan, including Starter.

What is private and what is public

A web service has two faces. Its public URL serves external HTTP traffic. Its private address is reachable only from other services in the same project.

Databases, Redis instances and buckets have no public address at all. They are reachable from services in their project, and from your machine through an authenticated tunnel — never directly from the internet.

Service-to-service calls

Call another service in the same project by its name rather than its public URL:

http://api:8080/internal/health

Using the public URL for internal traffic works, but sends the request out to the internet and back for no benefit — slower, and it consumes external bandwidth. Prefer the private address.

Inspect the topology

guidal network topology
guidal network endpoints

topology shows which services exist in the project and how they relate. endpoints lists the private addresses available to your services — useful when you are unsure of the exact hostname to call.

Isolation between projects

Projects are isolated from one another. A service in staging cannot reach a database in production, even within the same organization. This is the main reason to separate environments by project rather than by naming convention inside one project.

If two applications genuinely need to talk, expose the boundary deliberately over an authenticated public endpoint, rather than reaching for shared internal access.

Reaching a database from your machine

Databases have no public address, so connect through a tunnel:

guidal db proxy demo-db

This authenticates as you and forwards a local port. See Postgres for details.

Outbound traffic

Services can make outbound requests to the internet normally — calling third-party APIs, fetching dependencies, sending mail through a provider. No configuration is required.

Choosing what to expose

Give a service a port, and therefore a public URL, only if external clients need to reach it. A background worker has no port and is unreachable from outside by construction — which is exactly what you want for something that consumes a queue.