ingressd
Sign inGet started
Docspreview · subject to change
Docs / Guides / Failover and PoPs

Multi-node failover and PoPs

Every home and every app is served by several nodes. Edge DNS answers each app's DNS target with the nodes that can reach it right now, so losing a node or a tunnel does not take the app down.

Several nodes from the start#

A home keeps a WireGuard tunnel to each node it is attached to, and each of its apps is served by all of those nodes. With two nodes, one can go down, be rebooted or lose its tunnel while the other keeps serving.

  • By default a home is attached to all of your nodes. A node you enrol later is attached automatically.
  • Switch a home to selected nodes to choose them yourself. A home can use up to 16 nodes.
  • A node can only be removed from a home if the home keeps at least one node (unless it has no apps).

PoPs#

A PoP is a named location, such as a city or a datacentre, that groups nodes. Create PoPs under Nodes in the panel and assign each node to one. Several nodes in one PoP add capacity; nodes in different PoPs survive a provider or regional outage.

PoPs are labels for display today. Steering visitors to the nearest PoP and anycast addresses are planned for the managed network.

How failover DNS decides#

Each app has a DNS target such as k7m2q9xa.edge.example.net, answered by the panel's DNS server with a 30-second TTL. A node is in the answer when:

  1. it is connected to the panel, and
  2. its tunnel to the app's home is up (a WireGuard handshake in the last 180 seconds, or the connector connected), and
  3. its last health report is not failing.

If no node passes, the answer contains every attached node that is online, and if none is online, every attached node. The answer is never empty while nodes exist.

shellfrom anywhere
$ dig +short k7m2q9xa.edge.example.net
203.0.113.24
198.51.100.7

Clients and resolvers that respect the TTL move to the remaining nodes within about 30 seconds. Open connections on a node that goes down are lost; new ones go to a healthy node.

Addresses#

Tunnel addresses come from 100.64.0.0/10. Each home gets a /26 site block and each of its attachments a /30 inside it: the node is .1 and the home .2 of that /30. A home's tunnels never collide with each other or with any other home, and a router firewall rule for the site block covers nodes you add later.

What fails over, and what doesn't#

Event Effect
A node goes offline It leaves the DNS answer. The other nodes keep serving.
One tunnel goes down That node leaves the answer for that home's apps only.
The panel is unreachable Nodes keep serving their last config, with certificates from their local copies. The panel also answers the DNS targets, so new lookups fail once cached answers expire. A second name server is planned.
An apex record with A/AAAA No failover: the records point at fixed nodes.

Next: Smart DNS.