Skip to content

Run a custom internet-facing service

Want to run a websocket server, an MQTT broker, a custom API, or any other long-running process you wrote yourself, and have visitors reach it directly from the internet?

This article describes the pattern:

  1. Always run the process under a UNIX user.
  2. Then pick one of two routes to make it reachable:
    • Option A, plain TCP. You add a firewall rule yourself.
    • Option B, SSL/TLS (HTTPS, WSS). Cyberfusion support sets up HAProxy in front of the daemon to terminate SSL. This is paid work.

Option A and Option B are alternatives. Do one, not both. Option B handles the exposure itself, so no separate firewall rule is needed.

1. Run the process under a UNIX user

Node.js websocket server, Python MQTT broker, Go binary — all the same: it runs as a daemon under a UNIX user. The cluster starts it, keeps it running, and restarts it if it dies or hits its memory limit.

Open the UNIX user's page in Core:

Directly

  1. Navigate to 'Advanced' > 'UNIX Users'.
  2. Select the UNIX user.

Via the project

  1. Navigate to 'Projects'.
  2. Select the project.
  3. Navigate to 'Advanced'.
  4. Under the 'UNIX User' tile, click 'Manage'.

Then:

  1. Scroll to the 'Daemons' section and click '+'.
  2. Enter the command to run, for example node /home/user/websocket-server.js.
  3. Pick the nodes the daemon should run on.

Field reference, including 'Memory Limit (MiB)', 'CPU Limit (cores)', and the restart trigger file you can call from a deploy script: Daemons.

The process now runs, but is only reachable from the node itself. Step 2 opens it up.

2. Make it reachable from the internet: pick one

Option A: plain TCP via a firewall rule

Pick this when your service doesn't need SSL/TLS — plain TCP is fine for your protocol, or your clients handle encryption themselves.

By default the cluster's firewall blocks every port that isn't a standard service such as SSH, HTTP, HTTPS or mail.

Use a node with the 'Admin' group

A firewall rule for a custom port only works on a node that has the 'Admin' group. Other nodes aren't directly connected to the internet, so opening a port on them doesn't make it reachable from outside the cluster.

  1. Open the node with the 'Admin' group in Core.
  2. Scroll to 'Firewall Rules' and click '+'.
  3. 'Source': 'All' for anyone on the internet, or a firewall group to limit it to specific IP networks.
  4. 'Target': 'Port', and enter the port your daemon listens on.
  5. Save.

The port is now reachable from whichever source you picked.

Full reference: All about firewall rules.

Option B: SSL/TLS via HAProxy (paid)

Pick this when your service needs HTTPS or WSS — for example a websocket server that browsers connect to from an https:// page.

Cyberfusion runs HAProxy in front of the daemon. HAProxy holds the certificate, accepts the encrypted connection from the visitor, and forwards plain traffic to your daemon on the node. Your daemon never deals with certificates.

This is not self-service in Core. Contact support with:

  • The domain.
  • The port your daemon listens on.

This is paid work, charged as a one-off configuration fee.