External URLs

When a Worker, Container, or Daemon declares a named public endpoint, Alien creates an HTTPS endpoint for that resource endpoint.

Alien creates the infrastructure — the customer's network controls who can reach it. Depending on how the customer configures their environment, the same endpoint could be:

• On the public internet — for receiving webhooks from SaaS services like GitHub, Stripe, or Slack
• Available only to employees — behind a VPN or private DNS (tool.corp.internal), for dashboards and admin interfaces
• Available only to other services — as an internal API that other services in the customer's environment call over HTTP

Declaring Endpoints

Workers, Containers, and Daemons declare endpoints with .publicEndpoint(). Workers take a name only; Containers and Daemons also take the port to expose:

const api = new alien.Worker("api")
  .code({ type: "source", src: "./api", toolchain: { type: "typescript" } })
  .publicEndpoint("api")
  .build()

const web = new alien.Container("web")
  .code({ type: "image", image: "ghcr.io/acme/web:v1" })
  .publicEndpoint("web", 8080, "http")
  .build()

const agent = new alien.Daemon("agent")
  .code({ type: "image", image: "ghcr.io/acme/agent:v1" })
  .publicEndpoint("api", 8080, "http")
  .build()

Endpoint names must be lowercase DNS labels (letters, digits, hyphens).

Hostnames

Each deployment gets its own domain, and every endpoint becomes a hostname on it. By default the endpoint name is the host label — an endpoint named api is served at api.<deployment-domain>. Options control the hostname:

.publicEndpoint("api", 8080, { protocol: "http", hostLabel: "@" })
.publicEndpoint("tenants", 8080, {
  protocol: "http",
  hostLabel: "tenants",
  wildcardSubdomains: true,
})

What Gets Created

Each platform sets up the endpoint differently:

TLS

Because every deployment runs in a different cloud account, there is no shared certificate. Alien issues a TLS certificate per deployment and imports it into the customer's cloud — ACM on AWS, Certificate Manager on GCP, Key Vault on Azure — then renews and re-imports it automatically. The certificate lives in the customer's account, where the load balancer references it.

Customers who need to manage their own certificates can bring their own domain and certificate reference instead (see Custom Domains); Alien never sees the private key.

Getting the URL

Resource outputs include publicEndpoints, keyed by endpoint name:

From the manager API:

GET /v1/deployments/:id/info

Returns the resolved endpoint URLs per resource, so your control plane reads them instead of constructing them.

Use Cases

• AI APIs — expose an inference endpoint in the customer's cloud that your control plane calls
• Webhooks — receive callbacks from third-party services (Stripe, GitHub, Slack)
• Internal tools — customer employees access dashboards or admin interfaces
• Microservices — other services in the customer's environment call your Worker over HTTP

Custom Domains

Customers can use their own domain and TLS certificate instead of the auto-generated cloud URL. This is configured per-deployment via stack settings:

{
  "domains": {
    "customDomains": {
      "api": {
        "domain": "api.corp.megacorp.internal",
        "certificate": {
          "aws": { "certificateArn": "arn:aws:acm:us-east-1:..." }
        }
      }
    }
  }
}

Platform-specific certificate references:

Alien handles certificate import and load balancer configuration. The customer manages DNS.