01
Automated Let's Encrypt certificates
Once your domain is verified, SSL certificates are requested and installed automatically without manual ACME configuration.
Networking
Private by default.Exposed by choice.
Containers in a project communicate securely over an isolated internal network. Nothing touches the public internet until you explicitly open a port — complete with SSL, load balancing, and edge firewalls.
Project workflow01 / 03
01
SourceAutomatic Let's Encrypt
02
ControlHTTP, TCP, and UDP
03
ReleaseNo inbound ports for tunnels
Hubfly space projectNetwork · volumes · domains · team access
One project model
Traffic path
How requests flow through the network.
Public traffic terminates TLS at our regional edge proxy, clears firewall checks, and routes safely to exposed containers.
Public internet
Edge proxy · TLS · firewall · cache
Project private network
Web apppublic route
APIpublic route
Worker
Redis
Postgres
Admin
10.30.1.0/24 · reachable only from inside the project
HubTunnel · encrypted, no inbound port
Nothing exposed automatically
Newly deployed containers stay private until you deliberately map a public port.
Free SSL system subdomains
Every container instantly gets a secure default URL like <container>-<project>.<region>.hubfly.space.
Non-HTTP traffic support
Map dedicated public host ports for TCP/UDP traffic — ideal for databases, gRPC, and game servers.
Cloudflare proxy integration
Optionally proxy traffic through Cloudflare for additional DDoS protection.
Custom domains
Verify domain ownership once, route anywhere.
Once verified, custom domains can attach to containers or load balancers with automated SSL certificates.
| Method | Key | How it works | Best for |
|---|---|---|---|
| DNS TXT record | dns_txt | A unique token set as a TXT record on your domain apex | Apex and wildcard domain verification |
| CNAME pointing | cname | Points directly to <project>.<region>.hubfly.space | Quick subdomain setup |
| HTTP file check | http_file | Serves a challenge file under /.well-known/hubfly-challenge/ | Domains backed by an existing web server |
DNS TXT record
- Key
- dns_txt
- How it works
- A unique token set as a TXT record on your domain apex
- Best for
- Apex and wildcard domain verification
CNAME pointing
- Key
- cname
- How it works
- Points directly to <project>.<region>.hubfly.space
- Best for
- Quick subdomain setup
HTTP file check
- Key
- http_file
- How it works
- Serves a challenge file under /.well-known/hubfly-challenge/
- Best for
- Domains backed by an existing web server
02
Wildcard SSL support
Issue wildcard certificates using ACME DNS-01 challenges so every subdomain is covered under a single cert.
*.yourdomain.com
03
Automated 30-day renewals
Background workers auto-renew certificates 30 days prior to expiration, eliminating SSL downtime and calendar reminders.
04
Enforced HTTPS redirection
Automatically redirect all incoming HTTP traffic to secure HTTPS with a simple toggle switch.
Load balancing
Balance traffic seamlessly across containers.
Group containers into load balancers, pick your routing algorithm, and set target weights for canary deployments.
| Algorithm | Key | Behaviour |
|---|---|---|
| Round robin | round_robin | Distribute incoming requests sequentially across healthy targets |
| Least connections | least_conn | Route requests to whichever target currently has the lowest active connections |
| IP hash | ip_hash | Hash client IP addresses for persistent, sticky session routing |
Round robin
- Key
- round_robin
- Behaviour
- Distribute incoming requests sequentially across healthy targets
Least connections
- Key
- least_conn
- Behaviour
- Route requests to whichever target currently has the lowest active connections
IP hash
- Key
- ip_hash
- Behaviour
- Hash client IP addresses for persistent, sticky session routing
Weighted canary rollout
api-v190%api-v2 (canary)10%Health checks probe each target container. Failing instances are removed from the pool automatically until healthy.
HubTunnels
Connect to private cloud resources from your laptop.
Tunnels multiplex up to 64 streams over a single encrypted WebSocket connection. Access is authenticated with short-lived tokens, keeping private databases hidden from public internet scans.
hubfly-cli
# reach a private Postgres from your laptop
$ hubfly tunnel postgres 5432 5432
Tunnel established · localhost:5432 -> postgres:5432
Multiplexing over a single TLS WebSocket (max 64 streams)
$ psql -h localhost -p 5432 -U app
psql (16.2) · connected over private network
No public ports required
Connect to internal databases or microservices locally without opening public firewall ports.
Multi-container tunneling
Manage active tunnels to multiple project services simultaneously from our CLI or TUI.
Background daemon mode
Run local tunnels persistently in background daemon mode across restarts.
Edge proxy
Edge caching and firewall protection.
Our edge proxy runs at the front of every region so caching, rate limiting, and threat filtering apply before traffic touches your app code.
01
Stale-while-revalidate
Cached content is served instantly while edge nodes refresh assets in the background, keeping pages fast even if origin services lag.
02
Instant cache purging
Clear cached assets instantly by site, path pattern, or domain via dashboard or API with immediate global edge impact.
03
IP allow and deny lists
Block suspicious IP ranges outright or restrict internal admin tools to your corporate office network.
04
Rate limiting
Protect sensitive API endpoints and authentication routes from brute force attacks using configurable rate limits.
05
Circuit breakers
If a backend service fails, edge circuit breakers trip and return 503 errors instantly, preventing cascading outages.
06
Request tracing headers
Every response includes a request ID and Server-Timing metadata, giving you complete visibility into proxy and backend latency.
X-HubProxy-Request-Id · Server-Timing
Networking
Expose your applications safely.
Isolated networks, managed SSL, load balancing, and encrypted local tunnels built directly into your projects.