Every app is reachable over HTTPS the moment it deploys, joins a private account network, and serves its static files from every edge. None of that requires configuration.

HTTPS and domains

Every app gets https://<name>.kedge.run; previews use https://<name>--<branch>.kedge.run. Certificates are issued and replicated automatically.

For a custom domain, add it on the app page or with kedge domain add, then create the shown ownership TXT record and CNAME or apex A/AAAA/ALIAS records. kedge domain check reports verification and DNS diagnostics. Kedge issues the certificate when verification passes.

To register a new name rather than attach one you already own:

kedge domains search notes
kedge domains buy notes.example --app myapp

Registration draws on your credit balance and attaches the domain to the app. New registrations auto-renew; kedge domains autorenew <name> off stops that, and kedge domains list and kedge domains renew cover the rest.

public ingress and CDN

Compose ports publishes a service at the app's HTTPS hostname. expose remains private. Services with persistent volumes stay private; put a public service in front of them.

Static site files and the static half of handler sites are cached at every edge with ETag support. Known route misses return 404 without waking a VM. Deploys purge changed paths automatically; X-Cache shows edge hits. See sites & routing for route-tree and fallback behavior.

private networking

Apps join the account network by default. Sibling services resolve by bare name, and services in your other apps resolve under .internal. Other accounts and the public internet cannot initiate traffic.

Autoscaled services use a stable virtual address that wakes an instance on connect. Stable members keep one private address across pause, migration, and re-home.

Explicit project networks are not yet supported. Compose may omit networks or attach every service to the reserved external network named kedge. See the Compose reference.

Static addresses, host networking, custom network drivers, and cross-account networks are not exposed.

global routing

Latency-aware DNS and stable anycast addresses route requests to a nearby edge. Static files serve locally; handler and service requests use the encrypted fleet mesh to reach warm capacity. Autoscaled instances follow demand. Each stable member runs in one region at a time and can move without changing identity.

See global coverage for compute regions and measured network latency.