Networking & Policies
How apps and databases communicate inside a project, and how to control traffic with network policies.
Network policies decide which apps and databases in a project may communicate, and which may reach the internet. QuickStack is secure by default: connections have to be created explicitly.
By default, apps cannot talk to each other or reach the internet. You allow traffic by creating connections explicitly. This is a security feature that prevents accidental exposure of internal services.
There are two ways to change policies:
- Project network graph — the recommended, visual way to connect and disconnect apps across a project.
- App page → Domains & Networking — fine-grained editing of a single app's rules.
Change policies with the network graph (recommended)
The network graph visualizes every connection in a project and lets you edit them without switching between app pages.
- Open a project and click the Network graph icon next to the Table icon.
- Create, remove, or toggle connections as described below.
- Click Save & Apply and confirm. Policies take effect immediately — no redeploy needed.
Read the graph
| Element | Meaning |
|---|---|
| App node | An application, with its live pod status |
| Database node | A managed database (MariaDB, PostgreSQL, MongoDB, Redis) |
| Internet node | Access to the public internet |
| Solid edge | A complete, active connection |
| Dashed edge | An incomplete or cross-project connection |
| Arrowheads | The allowed direction of traffic |
| Edge label | The port and protocol |
Create a connection
- Hover the source app node. A connection handle appears on its right edge.
- Drag from that handle onto the target node's left handle.
- In the Add egress rule dialog, confirm the Port and Protocol, then click Add rule.
- Click Save & Apply and confirm.
QuickStack creates the matching ingress rule on the target automatically. To connect across projects, pick the other project inside the rule dialog.
Permissions You can only start a connection from an app you have write access to. Cross-project targets can be selected inside the rule dialog.
Remove a connection
Right-click an edge and choose Delete connection. This removes the underlying network policy rules on both sides.
Toggle internet access
Right-click an app node and choose Enable / Disable Egress Internet Access.
Arrange the layout
Drag nodes to reposition them. The layout is saved per project on the server, so it is shared across browsers. Reset restores the automatic layout.
Edit policies on the app page
For precise control over a single app, edit its rules on the Domains & Networking tab.
- Open the app and go to Domains & Networking → Network Policy.
- Toggle Network Policies on.
- Add Ingress rules (who can access this app) and Egress rules (where this app can connect).
- Click Save & Apply Changes and confirm.
Ingress rules — who can access this app?
- Under Ingress rules, click Add ingress rule.
- Fill in the dialog:
| Field | Description |
|---|---|
| Project | The project that contains the source workload |
| Source | The app or database allowed to connect |
| Port | The port on this app that the source may reach (1–65535) |
| Protocol | TCP or UDP |
- Click Add rule.
Egress rules — where can this app connect?
- Under Egress rules, click Add egress rule.
- Fill in Project, Target, Port, and Protocol the same way as an ingress rule.
- Click Add rule.
Recommended port
When the target is a managed database, QuickStack pre-fills the standard port and shows a Recommended badge: MariaDB/MySQL 3306, MongoDB 27017, PostgreSQL 5432, Redis 6379.
Internet Access
Internet Access is a separate egress switch: on lets the app open outbound connections to public addresses, off restricts it to the workloads you explicitly allow.
Copy an internal hostname
To connect another app to this one, open the rule's action menu and choose Copy internal hostname. See Internal service hostnames.
Connections are kept in sync
Network policies are bidirectional. When you add an ingress or egress rule between two apps, QuickStack creates the matching counterpart rule on the other side. Deleting a rule removes its counterpart too, so you only configure a connection from one side.
The counterpart is only written when the other app has Network Policies enabled and you have write access to it.
You need write access to both sides Linking to an app you can only read fails with an authorization error, because QuickStack cannot add the mirrored rule on that app. Ask an administrator to grant write access to the referenced app.
Internal service hostnames
Once a connection is allowed, apps reach each other over internal service hostnames:
svc-<app-id>.<project-id>.svc.cluster.localQuickStack builds the Kubernetes Service and its ports from the app's Domains and its network policy rules — there is no separate internal-port setting. Copy a ready-to-use URL from a rule's Copy internal hostname action:
postgres://user:pass@svc-app-abc.<project-id>.svc.cluster.local:5432/mydb
redis://svc-app-def.<project-id>.svc.cluster.local:6379
http://svc-app-ghi.<project-id>.svc.cluster.local:3000Set these as environment variables in your app, then deploy. Internal hostnames are scoped to a project; use a cross-project rule to connect across projects.
Troubleshooting
| Symptom | Fix |
|---|---|
| Connection refused between apps | Confirm an ingress rule exists on the receiving app for the port it listens on |
| App can't connect to a database | Add an egress rule on the app to the database, or an ingress rule on the database |
| App can't reach the internet | Turn on Internet Access in the app's egress rules |
| Another app can't reach this app | Add an ingress rule for that app, or a domain for external traffic |
| Name does not resolve | Verify you copied the full hostname, including the project ID |
| Policy doesn't seem to apply | Confirm there are no unsaved changes, then click Save & Apply Changes |
| A rule can't be created | You need write access to the app or database you are referencing |
| Can't drag a graph connection | You need write access to the source app; verify that its node is not read-only |
| Graph changes disappear after refresh | Click Save & Apply before leaving |
| Node positions don't stick | You need project write access to save layout changes |
| Graph is empty | The project has no apps, or none has network policies enabled yet |
Migration from presets Older QuickStack versions used fixed policy templates (Allow All, Internet Only, Project Apps Only, Deny All). After upgrading, these are converted to equivalent explicit rules on startup. The migration may create more connections than you need, so review the graph and adjust them.