Private connections between servers, without a VPN or open ports
How services, databases and servers in different clouds reach each other in Opfield: outbound connections with mTLS, Secure Links through relays, private databases with a user per link, and what Opfield leaves to you.
By the Opfield team4 min readUpdated
A common setup: the API runs with one cloud provider, its database with another, and the public website on a third server. To connect them, teams usually build a VPN between the servers or open the database port and limit it to a list of addresses. Both work, and both add something to maintain and something to attack.
Opfield takes a different path. Your servers only connect out, and private traffic between them travels through relays over authenticated connections. Below is how that works and where its limits are.
Servers connect out, nothing waits for them
Your servers need no open management ports. Each server runs small Opfield daemons that connect out to Opfield's relay, normally on 9443/tcp. The connection is always TLS, and the daemons expose no management API to the network. A server in any cloud, or behind NAT, can join as long as it can reach the relay.
Each server proves who it is
Adding a server takes one setup command. It carries a one-time enrollment token and the fingerprint of Opfield's certificate. On first start the daemon checks that certificate before it sends anything. Only when the fingerprint matches does it send the token, so a wrong DNS record or a proxy in the way cannot capture it.
Opfield then issues the server its own mTLS certificate from Opfield's internal CA. The daemon removes the token from its config and reconnects with the certificate. From then on the certificate is the server's identity, and Opfield checks it on every stream. There is no shared secret to leak, and deleting a server revokes its certificate, so the old daemon cannot reconnect as that server.
Public traffic reaches a service without a published port
A route on a public nginx server can point at a container, a deployment or a Compose service on another server. Opfield connects the two with a Secure Link: an authenticated private connection through the relay. The service publishes no host port, and the route follows it by identity, so a restart or a new release does not require a route change. Secure Links are available on every plan, Community included.
Databases stay private
Managed PostgreSQL, key-value stores and ClickHouse are private by default. When you link an application to a database, Opfield adds a private network to the container, gives it the connection variables and sends the traffic through an authenticated tunnel via the relay. The database does not listen on a public port.
Every link gets its own database user: a dedicated Postgres role, key-value ACL user or ClickHouse user. The application never receives the owner credentials, and deleting the link revokes that user. If an outside tool needs direct access, publishing a database port is an explicit choice. It requires database authentication, and Opfield does not open the host firewall for it. Managed databases need Personal or higher.
The relay runs as its own long-lived service, separate from the Opfield application. Ordinary Opfield updates do not recreate it, so established database sessions continue while the application restarts.
More than one relay
Private traffic does not have to depend on one machine. Next to the relay that comes with Opfield, you can add relays on other hosts to form a Relay Pool. Each relay's physical host counts as its fault domain, so two relays on the same host do not count as redundant.
New connections are spread across the ready relays. When you drain a relay, new connections go to the others while existing streams continue. Relay updates are signed and rolled out one relay at a time. Applications see one logical link and do not need to know which relay carries it. Opfield stays the control plane: your data goes through the relays, not through the Opfield application.
What Opfield does not do
This is not a VPN, and it does not try to be one. Opfield does not open firewalls, does not provide NAT traversal and does not create an overlay network. Servers stay independent, with no trust set up between them.
That leaves a few things to you:
- Every server must reach the relays assigned to it, on
9443/tcpby default. A relay is the one place that accepts incoming connections from your servers. - Public nginx servers need
80/tcpand443/tcpopen for web traffic. - A Secure Link protects the transport and the choice of target. Your application still decides who may call it.
Learn more
The documentation covers node enrollment, the Relay Pool, secure upstreams and database links step by step, including the firewall rules for each kind of server.