Edge

Edge decides what can reach a slice, and what a slice can reach. It is the fifth pillar beside Atomic (compute), Backbone (data), Canvas (sites) and Deed (identity): every rule about the network, in both directions, is declared in one place, the edge block of the Driftfile, and Drift enforces it itself rather than leaving it to your code.

The pages

• Hostnames and domainsThe names a slice answers on, and fronting another slice.
• The site gateA password in front of the site, checked by the slice's Deed.
• Rate limitingRequests per minute, across the whole slice.
• The IP allowlistOnly these networks reach the slice at all.
• EgressWhat a function may dial, and what it never may.
• LinksCalling another slice of yours, without leaving Drift.

The way in

A request for a slice meets Edge's rules in a fixed order, and each one runs before anything behind it is spent on the request:

1. The hostname. The router resolves the Host header to a slice: its default <user>-<slice>.ondrift.eu, one of its verified custom domains, or a host another slice of yours fronts for it. A host that names no slice answers 404 with {"error":"not found"}. See Hostnames and domains.
2. The allowlist. When the slice lists address ranges, a client outside all of them gets 403 with the code EDGE-ALLOW and goes no further. See The IP allowlist.
3. The rate limit. Every request that got this far counts against the slice's requests per minute, and past it the answer is 429. See Rate limiting.
4. The site gate. On a Canvas path, a slice with a gate asks for a username and password and answers 401 without one. /api/ and /trigger/ are never gated here. See The site gate.
5. The slice. What is left reaches Canvas, or Atomic for /api/ and /trigger/, where a Pulse's own auth block decides the rest. See Authentication.

The way out

• Egress. A slice is open (any public host) or on an allowlist (only the hosts it names), and the posture is rendered into the slice's own network rule. See Egress.
• The private ranges. Whatever the posture, the runtime refuses a function's connection to a private or reserved address, and to the slice's own control port. No declaration opens either.
• Links. A function calls another slice of yours through a relay in its own slice runtime, inside the cluster. The call never crosses the public internet and never passes the public router. See Links.

Every key

Each part is a fact about the slice, and each has a page that says how it behaves. The blocks and attributes of edge, one by one, are in the Driftfile reference; drift file explain edge prints the CLI's own description of each.

Declaring it

edge {
  allow      = ["203.0.113.0/24"]
  rate_limit = "600/min"
  links      = ["billing"]

  domain "app.example.com" {}

  egress {
    mode  = "allowlist"
    hosts = ["api.stripe.com"]
  }

  site_auth {
    realm = "Staging"
    user "alice" {
      password = env("ALICE_PASS")
    }
  }
}

An attribute or block you leave out is left alone. A file with no site_auth does not switch a gate off, a file with no links unlinks nothing, and a file with no egress keeps the posture the slice has. So edge can be adopted one part at a time, and two projects sharing a slice can each leave a part to the other. The exception is rate_limit: it is one of the slice's limits, so a file that writes it nowhere gives the slice the platform's own figure, and drift plan shows that as a change like any other (see Rate limiting).

A part that is present is the whole truth for its part, with one exception. links = ["billing"] removes a link to anything else, allow = [] opens the slice to every address again, and a site_auth block naming one user shuts out every other. domain blocks are the exception: they attach what is missing and never detach a hostname, because a deploy cannot tell a host another project uses from one you dropped.

drift apply checks site_auth, links, allow and hosts before anything is sent, and the file itself is checked with its position (Driftfile:13:16: ...), so a rate that cannot be held or a password variable that is not set refuses the whole file. drift plan reads the same parts from the slice, shows each beside what the file declares (+ added, ~ changed, - removed, blank unchanged), and changes nothing.

Edge decides, Deed verifies

The site gate is where Edge meets Deed, and the line between them is exact. Edge decides that a request must carry a credential; the slice's own Deed decides whether the credential is good. The router never holds a password digest. When a visitor answers the browser's prompt, the router sends the name and password to one route on the slice's Deed, which compares them against digests sealed in the slice, and acts on the yes or no it gets back. Once Deed holds a gate, Drift's control plane keeps its shape (on or off, the realm, the user names) and no digest at all. A Deed that cannot answer is a 503, never an admission. The site gate has the detail.

The same line runs through links. Edge decides which of your slices can reach another; it does not tell the callee who is calling. The X-Drift-Slice header a linked call may carry is a label anyone can write, so a slice that needs to know its caller checks a credential of its own, such as an API key.

What Edge does not hold

Content-Security-Policy stays with Canvas: it is a property of a document that a browser enforces, and Edge's rules are the ones Drift enforces itself. A function's own gate stays with Atomic: the auth block of a Pulse (an api_key) guards that one Pulse, and the site gate only ever guards Canvas paths.