---
title: "Addresses"
description: "The addresses of Cubes, sandbox links and your own domains, through the proxy in front of the platform (TLS, DDoS protection, caching) or direct to it, and the proxy's limits."
---

> Documentation Index
> Fetch the complete documentation index at: https://glac.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Addresses

Every public address of a [Cube](/docs/cube/addresses/) and of a [sandbox's link](/docs/sandbox/access/#links-to-its-ports) has two forms. The **proxied** one, which you get unless you ask otherwise, reaches the platform through a proxy in front of it ([Cloudflare](https://www.cloudflare.com/)): the proxy holds the TLS connection, absorbs attacks (DDoS), filters requests and can cache answers. The **direct** one reaches the platform's own edge with nothing in between, for what the proxy cannot carry.

| | Proxied | Direct |
|---|---|---|
| A Cube | `https://<app>-<project>.glac.run` | `https://<app>-<project>.direct.glac.run`, when the app asks for it (below) |
| A sandbox's link to a port | `https://<port>-<sandbox id>-<signature>.glac.run` | The same first part under `direct.glac.run`: `https://<port>-<sandbox id>-<signature>.direct.glac.run` |
| Your own domain | Registered with `proxied: true` (the default): a CNAME to `<token>.glac.run` | Registered with `proxied: false`: a CNAME to `<token>.direct.glac.run`, or A and AAAA records to the edge's addresses |

SSH is always direct.

## The proxy's limits

| | Limit | When it is reached |
|---|---|---|
| A request's body | 100 MB | 413, and the request does not reach your app |
| An answer | 125 seconds between two pieces of it | 524 |
| Protocols | HTTP and HTTPS only | No connection |
| WebSockets | Carried, but the proxy closes them when it updates itself | Reconnect, with a heartbeat |
| gRPC | Not through the proxy yet | Use the direct name |

For a larger upload, a request that runs longer without sending anything, or a protocol other than HTTP, use the direct name; or upload in parts, answer `202` at once and let the client ask again, or send something at least every 100 seconds on a long answer.

Answers of Cubes and of your own domains are cached by the proxy as their `Cache-Control` says. A sandbox link's answers are not cached, unless the sandbox's own answer sets `Cloudflare-CDN-Cache-Control`.

## Direct names

- **A Cube** gets its direct name with `direct: true` (`POST /v1/apps` or `PATCH /v1/apps/{app}`); its answer then has `direct_url`, and `false` takes it away. An app that did not ask has only its proxied address.
- **A sandbox's link** always has a direct form: put the link's first part under `direct.glac.run`. Nothing has to be set.
- A direct name has none of the proxy's protection: only the edge's own limits keep it, at most 500 connections at once from one visitor's address (an IPv6 /64 counts as one; past it, 429 `too_many_connections`), 1,000 to one sandbox or Cube, and 6,000 to one edge.

## Your own domain

`POST /v1/domains` with `{domain, app}` takes `proxied` too (`true` unless you say), and `PATCH /v1/domains/{id}` changes it.

- **Proxied**: point a CNAME from your name to `<token>.glac.run`. The proxy proves the name and issues its certificate, renewed for you. The answer's `proxy` says where it stands: `waiting`, `full` (waiting for a place), `pending` (the name is being proven and the certificate issued), `active`, or `failed` with the proxy's own words; `proxy.records` lists records you can add to have the certificate before you point the name.
- **Direct**: point a CNAME to `<token>.direct.glac.run`, or the A and AAAA records the answer gives together with its TXT proof; the edge issues a certificate from Let's Encrypt and renews it. A new name's certificate, a renewed one and a deleted name take effect at the next TLS handshake on every edge, and nothing else is restarted for them.
- **A name at the top of a domain** (`example.com`) cannot be proxied with A records: proxy it only if your DNS can flatten a CNAME there (ALIAS, ANAME); otherwise register it with `proxied: false`.
- Changing `proxied` changes the way to your Cube: the certificate is the new way's, so the domain goes back to waiting for it.
- Whether requests take the proxy is decided by your DNS: a name pointed at the direct target is served direct.

Source: https://glac.ai/docs/platform/addresses/index.mdx