Gateways and hostnames
Weik.io 2026.2A gateway is one door of one environment, with its hostnames, the networks it admits, its client certificate rule, its limits and where its certificates come from.
On this page
A gateway belongs to one environment and serves that environment’s APIs: api.example.com for production and api-test.example.com for devtest, both from the same gateway instances at the hub. A platform administrator creates gateways, and an API deployment is served on the gateways of its environment.
Create a gateway#
$ weikio gateway create internal --env production --hostname api.example.com --networks 10.0.0.0/8 --default -yTarget: https://hub.example, environment production (--env)
gateway internal created (environment production, revision 12)
Listens on the hub's entrance 'public' to callers in 10.0.0.0/8.
api.example.com points at this hub. Requesting its certificate from Let's Encrypt. HTTPS is served once it's issued (weikio describe gateway internal).Every reply to a gateway write says in one sentence who can reach it, and for each hostname where its certificate comes from and what it waits for. A hostname whose DNS doesn’t point at the hub yet says where it points instead.
What a gateway sets#
| Flag | What it sets |
|---|---|
-- |
The names the gateway answers on. Add a DNS record for each that points at the hub. |
-- |
The caller addresses it admits: internet, or a list of CIDR ranges. It’s required, so no gateway is left open by a forgotten flag. |
-- |
The listener it answers on. Every hub has public, port 443, and an installation can add more, such as a port on a private network. |
-- |
none, optional or required, with -- for the authorities whose client certificates it accepts. |
-- |
The calls one caller address may make in each gateway instance, such as 600/. |
-- |
The limit of a subscription that sets none of its own, counted across the instances. |
-- |
Where its APIs may send calls. |
-- |
The largest request body it accepts, such as 100MB. Without it the limit is 30,000,000 bytes. |
-- |
Where its hostnames’ certificates come from: automatic, public, platform, uploaded, or the name of your own ACME authority. |
-- |
Makes it the gateway a deployment or a subscription gets when it asks for none. |
-- |
hub, the default, or site for a gateway at a site. |
--like internal copies another gateway’s networks, entrances, client certificate rule, limits, upstreams and request size, but never its hostnames or environment. weikio gateway diff internal partner shows the rules two gateways set differently.
Two gateways in one environment#
An environment can have several gateways, such as internal for your own network and partner on the internet with client certificates:
$ weikio gateway create partner --env production --like internal --hostname partner-api.example.com --networks internet --client-certificate required --authority partners=partner-ca.pem
$ weikio api deploy finance/invoices@v1 --env production --gateways internal,partnerA subscription belongs to one gateway, so the partner’s key opens the API only on partner-api.example.com.
$ weikio get gateways --env productionThe list has each gateway’s hostnames, who serves it, whether it’s the default, whether the internet can reach it, and how many APIs and subscriptions it serves. weikio describe gateway internal says the same in sentences, with the limits in words, such as 600 calls per 1m from one caller address, counted by each APIM instance.
Stricter rules for one API#
A deployment can make a gateway’s rules stricter for itself, never looser. One API that only the accounting network may call gets narrower networks on the shared gateway:
$ weikio api set-rules finance/invoices@v1 --env production --gateway internal --networks 10.20.0.0/16 --caller-limit 60/1mA rule looser than the gateway’s is refused. --clear removes the deployment’s own rules.
Certificates#
The platform obtains and renews the certificate of every gateway hostname by itself, and no certificate file is placed on a host. For each name, the first of these that fits signs it:
- A name of the public entrance whose DNS points at the hub is proved to Let’s Encrypt over TLS on port 443.
- A name your own certificate authority covers, added with
weikio certificates authority add, is signed by that authority. - A name in a DNS zone the platform has a connection for, such as Cloudflare, Hetzner, Azure or an RFC 2136 server, is proved to Let’s Encrypt through DNS, wildcards included.
- Any other name, such as an
.internalone, is signed by the platform’s own authority.
A certificate of your own, uploaded with weikio gateway set internal --server-certificate company=chain.pem,key.pem, is served in place of the platform’s for the names it covers. weikio get certificates and Settings › Certificates list every name with its source, expiry and next renewal, and a problem says when a renewal keeps failing.
The gateway accepts TLS 1.2 and 1.3 only, with the AEAD suites on TLS 1.2. Certificates covers the hub’s own names and the DNS connections.
In the admin UI#
Settings › Gateways lists the gateways of every environment with their hostnames, who can reach each one and the gateway instances that serve them, and its New gateway button creates one.
