Peren documentation
Network policy
Which hosts a Worker may call, where credentials stay, and how to keep the peer port private.
A Worker can call only hosts you allow. Peren sends those requests from the node process. Peer listeners are plain TCP. Keep the peer port off the public network.
Network bindings
No ambient fetch
What it covers: every outbound HTTP request a Worker can cause.
What Peren does: global fetch and outbound binding fetch run in the node process. The request host must appear in the service’s outbound host set. That set comes from type = "outbound" allowed_hosts, plus hosts from configured AI, vector, images, or container bindings. A host outside the set fails before Peren sends the request.
Worker-controlled outbound fetch also refuses loopback, private, link-local, documentation, broadcast and unspecified IP destinations, plus localhost, even if one is listed in allowed_hosts. Peren applies that refusal to literal IP hosts and to hostnames before dialing when DNS resolves them into a refused range. This keeps Worker code from reaching the peer listener, local operator surfaces, metadata-style addresses, or another fleet’s local control port on a shared host.
There is no ambient network from the isolate. Undeclared hosts do not leave the process.
What you configure: which hosts appear in each outbound allowlist and which upstreams those hosts reach.
What you can check: fetch to a host outside the allowlist fails, and Peren does not send that request. See Outbound fetch and Outbound network.
Client mTLS and SigV4 outside the isolate
What it covers: client certificates and AWS signing keys used on outbound requests.
What Peren does: type = "mtls_certificate" loads PEM from process environment variables into the host. The Worker receives an opaque handle with no fetch method and cannot read the PEM. Pass the handle as fetch(url, { cf: { mtlsCertificate: env.NAME } }) on a fetch to an allowed host.
type = "aws_sigv4" signs in the node process. The Worker calls env.NAME.fetch. It does not receive access keys or secrets. Signing overwrites authorization, x-amz-date, x-amz-content-sha256, x-amz-security-token, and host in the host.
What you configure: which PEM and key environment variables exist before listeners open, which hosts those bindings may call, and rotation of that material.
What you can check: an mTLS binding on env is an object with no PEM. A SigV4 binding does not expose access keys. See Client mTLS and AWS SigV4.
Redirects are not followed
What it covers: redirected Worker-caused HTTP requests.
What Peren does: the node HTTP client does not follow redirects for Worker outbound requests. A 3xx response is returned to the Worker with its Location header. If the Worker chooses to issue a second request to that location, Peren applies the same allowlist and local-address refusal before sending it.
What you configure: explicit allowed hosts for every destination the Worker may call.
What you can check: an upstream redirect to loopback or another unlisted host remains a response, not a node-side follow-up request.
Peer listen and [mtls]
What it covers: the peer listener and control plane on [node].listen.
What Peren does: [mtls] certificate paths are required in the fleet file. Public sockets and the peer listener accept plain TCP. The process does not terminate inbound TLS with the [mtls] material.
Peer control mutations can require request signing when [control].require_signed_mutations = true. The signature is an HMAC over the target node id, method, path and query, body bytes, timestamp, and nonce using the node data directory’s credential key. The node keeps replay state in memory for the accepted timestamp window and rejects reused nonces for the same target node.
Outbound Worker client certificates are a separate mtls_certificate binding. They are not peer inbound TLS.
What you configure: keeping the peer port off the public network with host firewall rules, security groups, or cluster network policy. Terminate public TLS at a reverse proxy or load balancer in front of public sockets. Enable signed peer mutations only after the operators or automation that call those endpoints can send the control-signature headers.
What you can check: peer and public listeners accept plain TCP. Certificate paths in [mtls] do not make those listeners speak TLS. With signed mutations enabled, an unsigned POST /control/v1/node/drain on the peer listener returns 401. See Networking and ports.