The edge

Every request from the internet has to land somewhere first, before Synq knows which of your apps it's for. That somewhere is the edge: a reverse proxy (OpenResty) that sits on ports 80 and 443 and acts as the front door for the whole server. It answers the connection, handles HTTPS, works out which app the hostname belongs to, forwards the request to that app's container, and counts it on the way past.

Most of the time you never think about it: installing Synq sets the edge up for you, and every deploy that has a domain wires that domain into it automatically. You start caring about the edge directly in a few moments: when you move an existing server across, when you route a bare hostname at a port, when you rate-limit or block something, or when you ask "where is my traffic actually coming from?"

What the edge actually does

Four jobs, all on the request path:

• HTTPS for free. It ends TLS with a Let's Encrypt certificate for each domain and redirects plain HTTP to HTTPS once the certificate is in place. See HTTPS and certificates.
• Routing. It maps each hostname to the right container. That's how ten apps share one server and one IP, each on its own domain.
• Protection. Route rules (redirects, basic auth, rate limits, IP, country and user-agent bans, allow-lists) are enforced here, before a request reaches your app. See Redirects, basic auth and security rules.
• Traffic counting. Because it already sees every request, it tallies them (requests, bandwidth, status codes, latency, countries, paths) at essentially no cost. That fills the analytics on the Monitoring page and each project's Monitoring tab.

It also serves a few pages of its own: "not deployed yet" for a ready domain whose project isn't live, "Application unavailable" when an app doesn't answer, and "Service not found" for an unknown hostname (see What visitors see).

Taking over a server that's already serving

This is the headline case. You have a server that's already running nginx, Apache or Caddy on :80/:443 with real sites on it, and you want Synq to run the front door instead, without a moment where nothing is served.

The edge does this as a migration: it reads the existing proxy's sites, registers each one on the edge so it keeps serving, and only then takes the ports. The whole thing is journaled and rolls back cleanly if a step fails, so you never end up with neither proxy up.

synq edge sites

synq edge migrate

Putting a domain on the edge

Once the edge is running, giving an app a public hostname is one command. You can point a domain at an existing project, or bind a fresh one straight to a local port:

# Point a host at a port on this box (creates a tracked project for it)
synq edge domains add app.example.com --port 8080

# Attach a host to an existing project (uses that project's port)
synq edge domains add www.example.com --project prj_123 --primary

Registering a domain also verifies it and issues the HTTPS certificate. If DNS isn't pointing at the box yet, the command prints the record to add and you re-run verification once it has propagated. The full domain workflow (DNS records, verification, primary and redirects) lives in the Custom domains guide; in the panel, the Domains page lists every domain the edge serves.

Protecting a route

Rules are applied by the edge itself, so an abusive request is turned away before it costs your app anything. Scope a rule to a whole project, one domain, or a path prefix, and combine as many conditions as you like:

# 20 requests/second per client IP on the login path, allowing short bursts
synq edge rules add -p prj_123 --path /login --rate-limit 20 --burst 40

# Block two countries and a bad IP, answering with 403
synq edge rules add -p prj_123 --ban-country RU,CN --ban-ip 203.0.113.7 --block-status 403

# Only let an office network in; deny everyone else
synq edge rules add -p prj_123 --allow-cidr 198.51.100.0/24

synq edge rules list -p prj_123

In the panel, the project's Redirects and Security entries edit the same rules, including basic auth and path redirects. See Redirects, basic auth and security rules.

Custom directives

For the rare case the built-in settings don't cover, an organization admin can add raw OpenResty directives to one domain. Synq checks them, runs openresty -t and rolls back automatically if the edge refuses them. See Custom proxy config.

Watching your traffic

Because the edge counts every request as it passes, you get a traffic picture with no code and no cost to your visitors. There are three ways to see it.

In the dashboard, the Monitoring page shows every server and app together: health dials, live requests per second, error rate, latency percentiles, a per-app table and a world map. A project's Monitoring tab shows the same for one app (see App monitoring), and Logs → Server has the individual request lines (see Logs & monitoring).

Per server, the server's Overview tab adds its traffic panel and resource history (see Server monitoring and alerts).

From the terminal, the same numbers are three commands:

# Requests, bandwidth, and hourly periods
synq edge traffic -p prj_123

# Visitors, countries, and top paths for one domain
synq edge analytics -p prj_123 --domain app.example.com

# The recent raw request log, and follow it live
synq edge logs -p prj_123 --follow

Prefer the full command reference?

Everything here is a task-level walkthrough. For the complete list of synq edge subcommands and every flag (the interactive panel, up/repair, all the domain, rule and analytics options) see the Edge & monitoring CLI reference.

Related guides