Private networking is live on Miget. Your applications, databases and services can now join a private network of their own, resolve each other by name, and stay unreachable from the public internet. A VPN section sits on top of it, so the same network can be reached from your laptop, your office, or a cloud account you already run.
What shipped
A new Networking section in the dashboard, and a matching set of API endpoints.
- A network per region. Every workload in a region can share one private network. Until now, an application on one resource had no private path to a database on another. It does now.
- A subnet and a resolver, ready on creation. A new network comes up with a
/24already carved out and a DNS resolver of its own. The usual path is: create it, attach the database, attach the application, done. - A workload answers to a name, not to an address. The name is what belongs in a connection string. The address behind it moves whenever the workload rolls, and the name does not.
- An address range you control. The default is
10.224.0.0/16. Anything RFC1918 and/22or larger works, and a range that would clash with the platform is refused as you type it rather than failing later.
Reaching it from outside
Four terminators, and you can run more than one on the same network.
- WireGuard, per person or per machine. Add a device, download its configuration, import it. The private key is generated for the device and never stored, so the file downloads exactly once - if it is lost, delete the device and add another.
- Tailscale, joining a tailnet you already run with an auth key.
- Cloudflare WARP, joining a Cloudflare organization with a service token.
- IPsec site-to-site, joining a whole remote network: an AWS VPC, a data centre, an office.
Tailscale and Cloudflare WARP need routes telling the network which ranges live behind them, because those ranges live in your configuration rather than ours. Routes are staged and applied together, because applying restarts every attached workload - so you add every range you need and pay that cost once.
What it costs
The private network itself is on every plan. The terminators are priced per option:
- $29/mo per gateway you enable. Per gateway, not per network, so a network running both WireGuard and Tailscale is charged twice.
- $199/mo per site-to-site tunnel, because each tunnel permanently holds one of the region's public addresses.
Both are included on Enterprise plans.
How to use it
From the dashboard
Open Networking, create a network, and attach the workloads you want on it. Attaching restarts the workload - an interface cannot be added to a running container - so for a database that means a database restart, and the confirmation dialog says so before you commit. An application created with a network chosen up front skips the restart entirely.
Add a VPN from the Add VPN menu on the network, and for Tailscale or Cloudflare WARP stage the peer ranges and apply them together.
From the API
# Create a network in a region
curl -X POST https://app.miget.com/api/v1/vpcs \
-H "Authorization: Bearer $MIGET_API_TOKEN" \
-d '{"region_id": "...", "cidr_v4": "10.224.0.0/16"}'
# It answers pending. Poll until status is active, then read the
# derived resolver, the v6 range and the VPN pool.
curl https://app.miget.com/api/v1/vpcs/$VPC_UUID \
-H "Authorization: Bearer $MIGET_API_TOKEN"
# A default subnet already exists - list it rather than creating one
curl https://app.miget.com/api/v1/vpcs/$VPC_UUID/subnets \
-H "Authorization: Bearer $MIGET_API_TOKEN"
# Attach a workload
curl -X POST https://app.miget.com/api/v1/vpcs/$VPC_UUID/attachments \
-H "Authorization: Bearer $MIGET_API_TOKEN" \
-d '{"subnet_uuid": "...", "attachable_type": "Addon", "attachable_uuid": "..."}'
An application can join a network at creation time instead, with vpc_subnet_uuid on POST /api/v1/apps - which avoids the restart an attach costs.
Access is governed by a new network:* permission group: network:view to read, network:operate to attach and detach, network:manage for everything else. Site-to-site connections are limited to the workspace owner, because each one spends a public address and moves the bill.
Some deliberate limits
- A network cannot span regions. A workspace working in two regions gets one network in each.
- The name and the address range are fixed once created. The whole address plan is derived from them on every action, so they cannot drift.
- Storage cannot be attached - a volume has no pod to address - and neither can an addon that belongs to a managed service.
- An attachment's name goes stale after a rollout until the next attach, detach or route change, and a cron job gets no name at all.
What is next
The dashboard covers all four terminators today. The API covers networks, subnets and attachments, plus gateways, devices, routes and site connections. The full endpoint list, including the 410 you get from reading a WireGuard configuration twice, is in the API changelog.