Tenant boundary
Network membership and identities are scoped to one tenant environment.
Private Networking
Applications and approved peers communicate inside a tenant-owned WireGuard network. Production traffic currently uses the managed relay path, keeping the network boundary predictable while direct transport remains outside the public offer.
For application systems that need internal APIs, workers, and data resources to stay off the public Internet while selected web or API routes remain reachable.
01
What it gives the application
The capability, the operating value, and the boundary are described together.
Managed relay
The production data plane currently traverses the configured Tabbify relay.
Private services
Internal workloads communicate without publishing every application port to the Internet.
Explicit ingress
Only selected applications receive a public route or custom domain.
02
How it works in a production engagement
Start with evidence, make the current boundary explicit, then apply the verified workflow.
- 01
Create the network
Define the tenant boundary for the application environment.
- 02
Join workloads
Applications and approved nodes receive scoped network membership.
- 03
Route privately
Internal traffic follows the production relay path inside the tenant network.
- 04
Publish selectively
Attach public ingress only to the application routes that need it.
03
Included in the current capability
These are the available building blocks; the workload-specific scope is confirmed during review.
- ✓Tenant-scoped membership
- ✓Workload network identity
- ✓Managed production relay
- ✓Internal application addresses
- ✓Selected public ingress
- ✓Membership revocation controls
Current limitations
This is a tenant-private network, not a shared catalogue between independent customers. Production transport currently relies on the managed relay path.
Production Operations PilotApply this capability to one real workload.