Overview
A network is a private space for your resources with its own address range. Resources in it reach each other by name; resources in different networks can’t reach each other.
With several machines, a network spans all of them.
When to use it
- Keep a project’s database away from everything else.
- Fixed addresses in a range you choose.
- Subnets for apps and data.
How it works
- Bridge networks
- Each network is one Docker bridge network whose range is your CIDR.
- Private DNS
- Every resource answers to <name>.<kind>.internal inside its network.
- WireGuard mesh
- Across machines, a mesh container per machine carries the network over an encrypted tunnel.
Subnets are named ranges inside the network, so they reach each other directly. A network without internet has no route out. On two or more machines, every network exists on each of them with the same range, and a stand-in on each machine answers for resources that run on another.
Architecture
- api to Mesh (WireGuard): orders.database.internal
- Mesh (WireGuard) to Mesh (WireGuard): encrypted
- Mesh (WireGuard) to orders
Flows
Reaching a database on another machine
- The app looks up orders.database.internal.
- On its machine, a stand-in answers with the database’s address.
- Packets cross the WireGuard tunnel to the database’s machine.
Set it up
In the console
- Open Networks and choose New network.
- Name it and give it a range like 10.20.0.0/16.
- Choose it in the forms of what you create next.
With the CLI
enclave network create backend --cidr 10.20.0.0/16 --waitWith OpenTofu
OpenTofu configuration
resource "enclave_network" "backend" {
name = "backend"
cidr = "10.20.0.0/16"
}Settings reference
Every setting and output of the OpenTofu resource; the console and the CLI use the same names in their own words. Generated from platform 4d30582.
| Name | Type | Use | What it does |
|---|---|---|---|
cidr | text | required | Private IPv4 range, /16 to /28, e.g. 10.40.0.0/16. |
name | text | required | Name of the network: 3–40 lowercase letters, digits or hyphens, starting with a letter. Changing it replaces the network. |
internet | true or false | optional | Route to the internet. Without it, nothing in the network can publish a host port. |
project | text | optional | The project to create it in. Defaults to the provider's project (ENCLAVE_PROJECT, else default). Changing it replaces the resource. |
subnet | list of objects | optional | Named ranges inside the network (default: one subnet covering it). |
docker_network | text | output | The engine network's name. |
gateway | text | output | The network's gateway address. |
id | text | output | Resource ID. |
Limits and security
Good to know
- Ranges may not overlap another network or the default one.
Security
- Networks are isolated from each other; tunnels between machines are encrypted.