peren
Menu
Search Peren documentation
Start typing to search the documentation.
    Browse documentation
    On this page
    Search Peren documentation
    Start typing to search the documentation.

      Peren documentation

      Ports and endpoints

      Peer listen, public sockets, health endpoints, and what peren dev changes.

      Peren binds one peer listener and zero or more public sockets. Both are plain TCP. The process does not terminate inbound TLS.

      Peer listener

      [node].listen is the peer listen address. Control routes that mutate admission and deployment records are served only on this listener. A request to the same path on a public socket returns 404.

      Live drain that refuses new work:

      POST /control/v1/node/drain

      You keep the peer port off the public network.

      When [control].require_signed_mutations = true, mutation requests on the peer listener must include Peren control-signature headers:

      Header Meaning
      x-peren-target-node UUID of the node that should apply the mutation.
      x-peren-request-timestamp-ms Unix timestamp in milliseconds.
      x-peren-nonce Unique nonce for this target node and timestamp window.
      x-peren-signature-version Signature format version.
      x-peren-signature HMAC over target node, method, path and query, body, timestamp, and nonce.

      The node rejects missing signatures, stale timestamps, body tampering, and nonce replay. Existing fleet files keep unsigned mutations unless require_signed_mutations is enabled.

      Public sockets

      Each [[sockets]] entry has its own listen address and targets a named service. Application traffic reaches Workers through that address.

      Endpoints on every listener

      These routes exist on the peer listener and on each public socket:

      Path Behavior
      /healthz Returns 200 when the listener answers.
      /readyz Returns 200 when readiness is true, otherwise 503.
      /metrics Prometheus text metrics for the process.

      peren dev versus peren serve

      Command Listen addresses
      peren dev Rebinds loopback peer and socket listens to port 0 (and forces a memory bucket for the session). Use the name: http://… lines it prints.
      peren serve Keeps the configured listen addresses from the fleet file.

      Non-loopback addresses are refused for peren dev.

      [mtls]

      [mtls]
ca_cert_path = "./certs/ca.pem"
leaf_cert_path = "./certs/leaf-cert.pem"
leaf_key_path = "./certs/leaf-key.pem"

      These paths are required in config. They do not terminate inbound TLS on peer or public listeners. Outbound Worker client certificates are a separate mtls_certificate binding. See Networking and Client mTLS.