Guides

APIs and backends

Name: Skiff
Author: Skiff

A backend usually needs more than one public URL: internal services, a database, background work, and protection from too much traffic. Here's how those fit together on Skiff.

Private services

Turn on Private service under a project's Settings → Access and it stops being reachable from the internet within seconds. The router answers as if it doesn't exist, no certificate is issued for it, and its previews are private too.

Calling one service from another

Every project has a stable internal address, shown on its overview. It works from your team's other projects, workers and jobs, stays the same across deploys, and spreads calls across replicas:

from another project

curl http://billing-api:8080/invoices

Traffic stays on your team's private network, and other teams on the server can't reach it. A project needs one deploy after upgrading Skiff for its internal address to work. Apps deployed with skiff deploy also need an up-to-date CLI, and their network comes from [deploy] in skiff.toml.

An internal address has no authentication of its own. Anything on your team's network can call it, so keep checking credentials in the service if that matters.

Rate limits

Set a limit under Settings → Access, in requests a minute per visitor. A visitor can use a minute's allowance in one burst, and it refills steadily. Past that they get a 429 with a Retry-Afterheader, before the request reaches your app. Calls over internal addresses aren't counted.

A visitor is an IP address, or an IPv6 /64. If you put a CDN like Cloudflare in front of Skiff, all its traffic comes from a few addresses and would share one allowance, so set limits at the CDN instead.

gRPC

gRPC services work with no setting to change, including streaming. Clients connect over HTTPS as usual, and Skiff speaks plain-text HTTP/2 to your app, so have the server listen without TLS on its port. A service with no web page passes its deploy check by answering over HTTP/2. Set the project's port yourself if the image exposes more than one. gRPC calls count toward a rate limit like any other request, and over an internal address they go directly to the service.

The rest of a backend

Databases:managed Postgres, MySQL, MongoDB and Redis, with the connection URL added for you. Redis isn't included in daily backups.
Migrations: a release command runs before each new version goes live, and a failure stops the deploy.
Background work:workers and scheduled jobs run from your app's image.
Real-time: WebSockets and server-sent events work. When a new version goes live, the old one is stopped, so clients should reconnect.

What Skiff doesn't do yet

Raw TCP or UDP from outside. The router speaks HTTP and gRPC, and a deploy needs an answer in one of them to pass its health check.
More than one server.Replicas and autoscaling work within your server. There's no failover if it goes down, and no database replicas.