Origins and health checks

Origins

Per service, one or more origins with:

Field	Meaning
address, port	where the edge connects
tls, ssl_verify, sni	TLS to the origin, certificate verification, SNI to present
weight	share of traffic (round robin by weight)
maxconn	connection cap per edge towards this origin

origin_host and origin_sni override the Host header and SNI sent to the origin when they differ from the public FQDN.

Health checks

Field	Default
method, path	GET /
interval	10 s
rise / fall	2 / 3
expect	optional status or body match

An origin that fails fall checks in a row is taken out of rotation; it returns after rise successful checks. With all origins down the edge answers 503.

Origin shielding

Forward proxies sit between edge and origin; the forward_proxy weight decides how much traffic goes through them. Together with an allowlist or a private backhaul (IPsec, MPLS, CrossConnect) your origin is never reachable from the internet.

Timeouts

Client and server timeouts default to 1 hour, tunnel timeouts (WebSockets) to 4 hours.