Private networking

Every service, database and Redis database has a private hostname in the form <name>.<environment>.dekka.internal, such as api.production.dekka.internal. Other services in the same environment use it to reach it without leaving Dekka's network, and nothing outside the environment can.

Call another service privately

Use the other service's private hostname and the port it listens on. Dekka sets DEKKA_PRIVATE_DOMAIN on every service and PORT on web services, so a reference builds the address for you and keeps it current:

API_INTERNAL_URL=http://${{api.DEKKA_PRIVATE_DOMAIN}}:${{api.PORT}}

Here api is the other service's name. The hostname uses the service's name, so renaming a service or its environment changes it from the next deploy, and Dekka updates references that point at a renamed service.

Do I need private hostnames for databases?

No. A connection gives your service a DATABASE_URL or REDIS_URL with the right host, so use that rather than building the address yourself.

What can't use private networking?

Buckets have no private hostname and are reached through S3_ENDPOINT. Services in different environments or projects can't reach each other privately, which is what keeps staging away from production data.