External URLs

When a Worker, Container, or Daemon declares a named public endpoint, Alien creates an HTTPS endpoint for that resource endpoint. Containers can also declare TCP endpoints for non-HTTP protocols (see TCP Endpoints).

Alien creates the infrastructure — the customer's network controls who can reach it. Depending on how the customer configures their environment, the same endpoint could be:

• On the public internet — for receiving webhooks from SaaS services like GitHub, Stripe, or Slack
• Available only to employees — behind a VPN or private DNS (tool.corp.internal), for dashboards and admin interfaces
• Available only to other services — as an internal API that other services in the customer's environment call over HTTP

Declaring Endpoints

Workers, Containers, and Daemons declare endpoints with .publicEndpoint(). Workers take a name only; Containers and Daemons also take the port to expose:

const api = new alien.Worker("api")
  .code({ type: "source", src: "./api", toolchain: { type: "typescript" } })
  .publicEndpoint("api")
  .build()

const web = new alien.Container("web")
  .code({ type: "image", image: "ghcr.io/acme/web:v1" })
  .publicEndpoint("web", 8080, "http")
  .build()

const agent = new alien.Daemon("agent")
  .code({ type: "image", image: "ghcr.io/acme/agent:v1" })
  .publicEndpoint("api", 8080, "http")
  .build()

Endpoint names must be lowercase DNS labels (letters, digits, hyphens).

Hostnames

Each deployment gets its own domain, and every endpoint becomes a hostname on it. By default the endpoint name is the host label — an endpoint named api is served at api.<deployment-domain>. Options control the hostname:

.publicEndpoint("api", 8080, { protocol: "http", hostLabel: "@" })
.publicEndpoint("tenants", 8080, {
  protocol: "http",
  hostLabel: "tenants",
  wildcardSubdomains: true,
})

TCP Endpoints

Declare an endpoint with protocol "tcp" to expose a non-HTTP protocol — a database wire protocol, a message broker, a custom binary protocol:

const postgres = new alien.Container("postgres")
  .code({ type: "image", image: "postgres:16" })
  .publicEndpoint("pg", 5432, "tcp")
  .build()

TCP endpoints route through a network load balancer instead of an HTTP front door. Traffic passes through to the container — Alien does not terminate TLS, so the workload owns its own protocol and encryption. The endpoint still gets a hostname on the deployment domain, and clients connect to it on the declared port.

During rollouts and deletes, replicas are removed from the load balancer before they stop, and existing connections drain within the workload's stopGracePeriod.

What Gets Created

Each platform sets up the endpoint differently:

TLS

Because every deployment runs in a different cloud account, there is no shared certificate. Alien issues a TLS certificate per deployment and imports it into the customer's cloud — ACM on AWS, Certificate Manager on GCP, Key Vault on Azure — then renews and re-imports it automatically. The certificate lives in the customer's account, where the load balancer references it.

Customers who need to manage their own certificates can bring their own domain and certificate reference instead (see Custom Domains); Alien never sees the private key.

Getting the URL

Resource outputs include publicEndpoints, keyed by endpoint name:

From the manager API:

GET /v1/deployments/:id/info

Returns the resolved endpoint URLs per resource, so your control plane reads them instead of constructing them.

Use Cases

• AI APIs — expose an inference endpoint in the customer's cloud that your control plane calls
• Webhooks — receive callbacks from third-party services (Stripe, GitHub, Slack)
• Internal tools — customer employees access dashboards or admin interfaces
• Microservices — other services in the customer's environment call your Worker over HTTP

Custom Domains

Customers can use their own domain and TLS certificate instead of the auto-generated cloud URL. This is configured per-deployment via stack settings:

{
  "domains": {
    "customDomains": {
      "api": {
        "domain": "api.corp.megacorp.internal",
        "certificate": {
          "aws": { "certificateArn": "arn:aws:acm:us-east-1:..." }
        }
      }
    }
  }
}

Platform-specific certificate references:

Alien handles certificate import and load balancer configuration. The customer manages DNS.