networking

Name: networking
Author: digitalocean-labs

34stars4forks

How to install networking?

digitalocean-labs/do-app-platform-skills/networking

$npx -y skills add digitalocean-labs/do-app-platform-skills --skill networking

Installs into the current project.

Summary

Configure domains, routing, CORS, VPC, static IPs, and inter-service communication for DigitalOcean App Platform. Use when setting up custom domains, subdomain routing, cross-origin API access, or secure database connectivity.

Files · 1

View on GitHub

SKILL.md

1	# App Platform Networking Skill
2
3	Configure domains, routing, CORS, VPC, static IPs, and inter-service communication.
4
5	## Quick Decision
6
7	```
8	What networking do you need?
9	├── Custom domain?
10	│ └── YES → See domains-dns.md
11	│
12	├── Multiple services on one domain?
13	│ ├── Different paths (/api, /app) → Path-based routing
14	│ └── Different subdomains (api., app.) → Subdomain routing
15	│
16	├── Frontend calling API across origins?
17	│ └── YES → CORS configuration
18	│
19	├── Secure database connectivity?
20	│ └── YES → VPC + trusted sources
21	│
22	└── Need static outbound IP?
23	└── YES → Dedicated egress
24	```
25
26	---
27
28	## When to Use
29
30	\| Scenario \| Need This Skill \|
31	\|----------\|-----------------\|
32	\| Starter domain only \| No \|
33	\| Custom domain \| Yes \|
34	\| Multiple services, different paths \| Yes \|
35	\| Multiple subdomains \| Yes \|
36	\| Cross-subdomain API calls (CORS) \| Yes \|
37	\| Secure database access via VPC \| Yes \|
38	\| Firewall allowlisting (egress IP) \| Yes \|
39
40	---
41
42	## Quick Reference
43
44	\| Feature \| App Spec Field \| Example \|
45	\|---------\|----------------\|---------\|
46	\| Custom domain \| `domains[].domain` \| `example.com` \|
47	\| Wildcard \| `domains[].wildcard` \| `true` \|
48	\| Path routing \| `ingress.rules[].match.path.prefix` \| `/api` \|
49	\| Subdomain routing \| `ingress.rules[].match.authority.exact` \| `api.example.com` \|
50	\| CORS \| `ingress.rules[].cors` \| See reference \|
51	\| VPC \| `vpc.id` \| UUID \|
52	\| Dedicated egress \| `egress.type` \| `DEDICATED_IP` \|
53
54	---
55
56	## Path-Based Routing (Quick Start)
57
58	```yaml
59	ingress:
60	rules:
61	- component: { name: api }
62	match: { path: { prefix: /api } }
63
64	- component: { name: frontend }
65	match: { path: { prefix: / } }
66	```
67
68	Rule order matters: Specific rules first.
69
70	Full guide: See [ingress-routing.md](reference/ingress-routing.md)
71
72	---
73
74	## Subdomain Routing (Quick Start)
75
76	```yaml
77	domains:
78	- domain: example.com
79	type: PRIMARY
80	wildcard: true
81	zone: example.com
82
83	ingress:
84	rules:
85	- component: { name: api }
86	match:
87	authority: { exact: api.example.com }
88	path: { prefix: / }
89
90	- component: { name: app }
91	match:
92	authority: { exact: app.example.com }
93	path: { prefix: / }
94	```
95
96	Full guide: See [domains-dns.md](reference/domains-dns.md)
97
98	---
99
100	## CORS (Quick Start)
101
102	```yaml
103	ingress:
104	rules:
105	- component: { name: api }
106	match: { path: { prefix: /api } }
107	cors:
108	allow_origins:
109	- exact: https://app.example.com
110	allow_methods: [GET, POST, PUT, DELETE, OPTIONS]
111	allow_headers: [Content-Type, Authorization]
112	allow_credentials: true
113	```
114
115	Note: With `allow_credentials: true`, use exact origins only (no regex).
116
117	Full guide: See [cors-configuration.md](reference/cors-configuration.md)
118
119	---
120
121	## VPC + Trusted Sources (Quick Start)
122
123	```yaml
124	vpc:
125	id: your-vpc-uuid
126	```
127
128	VPC CIDR whitelisting (recommended):
129	```bash
130	doctl vpcs get $VPC_ID --format IPRange # e.g., 10.126.0.0/20
131	doctl databases firewalls append $CLUSTER_ID --rule ip_addr:10.126.0.0/20
132	```
133
134	\| Setup \| Trusted Source Rule \|
135	\|-------\|---------------------\|
136	\| Public only \| `app:$APP_ID` \|
137	\| VPC enabled \| `ip_addr:<vpc-cidr>` \|
138
139	Critical: Bindable variables return PUBLIC hostnames even with VPC. Use private URLs:
140	```bash
141	doctl databases connection --private <cluster-id> --format URI
142	```
143
144	Full guide: See [vpc-trusted-sources.md](reference/vpc-trusted-sources.md)
145
146	---
147
148	## Reference Files
149
150	- [domains-dns.md](reference/domains-dns.md) — Domain types, DNS setup, wildcards, TLS, CAA
151	- [ingress-routing.md](reference/ingress-routing.md) — Path routing, rewrites, redirects, authority matching
152	- [cors-configuration.md](reference/cors-configuration.md) — CORS fields, patterns, credentials
153	- [vpc-trusted-sources.md](reference/vpc-trusted-sources.md) — VPC setup, trusted sources matrix, private URLs
154	- [static-ips-egress.md](reference/static-ips-egress.md) — Ingress IPs, dedicated egress, HTTP/2, internal ports
155	- [complete-patterns.md](reference/complete-patterns.md) — 5 complete architecture patterns
156
157	---
158
159	## Common Issues
160
161	\| Issue \| Fix \|
162	\|-------\|-----\|
163	\| Domain not resolving \| Check DNS records, allow 72h propagation \|
164	\| SSL certificate error \| Add CAA records for letsencrypt.org + pki.goog \|
165	\| CORS preflight fails \| Add OPTIONS to allow_methods \|
166	\| VPC connection refused \| Use VPC CIDR whitelisting, not app-based rules \|
167	\| Wrong component serves \| Reorder rules (specific first) \|
168
169	---
170
171	## Integration with Other Skills
172
173	- → designer: Add domains/ingress to app spec
174	- → troubleshooting: Debug DNS, CORS, VPC issues
175	- → postgres: VPC

People who liked this also viewed

6 picks

Type

networking

34stars4forks

View on GitHub

How to install networking?

digitalocean-labs/do-app-platform-skills/networking

$npx -y skills add digitalocean-labs/do-app-platform-skills --skill networking

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# App Platform Networking Skill
2
3	Configure domains, routing, CORS, VPC, static IPs, and inter-service communication.
4
5	## Quick Decision
6
7	```
8	What networking do you need?
9	├── Custom domain?
10	│ └── YES → See domains-dns.md
11	│
12	├── Multiple services on one domain?
13	│ ├── Different paths (/api, /app) → Path-based routing
14	│ └── Different subdomains (api., app.) → Subdomain routing
15	│
16	├── Frontend calling API across origins?
17	│ └── YES → CORS configuration
18	│
19	├── Secure database connectivity?
20	│ └── YES → VPC + trusted sources
21	│
22	└── Need static outbound IP?
23	└── YES → Dedicated egress
24	```
25
26	---
27
28	## When to Use
29
30	\| Scenario \| Need This Skill \|
31	\|----------\|-----------------\|
32	\| Starter domain only \| No \|
33	\| Custom domain \| Yes \|
34	\| Multiple services, different paths \| Yes \|
35	\| Multiple subdomains \| Yes \|
36	\| Cross-subdomain API calls (CORS) \| Yes \|
37	\| Secure database access via VPC \| Yes \|
38	\| Firewall allowlisting (egress IP) \| Yes \|
39
40	---
41
42	## Quick Reference
43
44	\| Feature \| App Spec Field \| Example \|
45	\|---------\|----------------\|---------\|
46	\| Custom domain \| `domains[].domain` \| `example.com` \|
47	\| Wildcard \| `domains[].wildcard` \| `true` \|
48	\| Path routing \| `ingress.rules[].match.path.prefix` \| `/api` \|
49	\| Subdomain routing \| `ingress.rules[].match.authority.exact` \| `api.example.com` \|
50	\| CORS \| `ingress.rules[].cors` \| See reference \|
51	\| VPC \| `vpc.id` \| UUID \|
52	\| Dedicated egress \| `egress.type` \| `DEDICATED_IP` \|
53
54	---
55
56	## Path-Based Routing (Quick Start)
57
58	```yaml
59	ingress:
60	rules:
61	- component: { name: api }
62	match: { path: { prefix: /api } }
63
64	- component: { name: frontend }
65	match: { path: { prefix: / } }
66	```
67
68	Rule order matters: Specific rules first.
69
70	Full guide: See [ingress-routing.md](reference/ingress-routing.md)
71
72	---
73
74	## Subdomain Routing (Quick Start)
75
76	```yaml
77	domains:
78	- domain: example.com
79	type: PRIMARY
80	wildcard: true
81	zone: example.com
82
83	ingress:
84	rules:
85	- component: { name: api }
86	match:
87	authority: { exact: api.example.com }
88	path: { prefix: / }
89
90	- component: { name: app }
91	match:
92	authority: { exact: app.example.com }
93	path: { prefix: / }
94	```
95
96	Full guide: See [domains-dns.md](reference/domains-dns.md)
97
98	---
99
100	## CORS (Quick Start)
101
102	```yaml
103	ingress:
104	rules:
105	- component: { name: api }
106	match: { path: { prefix: /api } }
107	cors:
108	allow_origins:
109	- exact: https://app.example.com
110	allow_methods: [GET, POST, PUT, DELETE, OPTIONS]
111	allow_headers: [Content-Type, Authorization]
112	allow_credentials: true
113	```
114
115	Note: With `allow_credentials: true`, use exact origins only (no regex).
116
117	Full guide: See [cors-configuration.md](reference/cors-configuration.md)
118
119	---
120
121	## VPC + Trusted Sources (Quick Start)
122
123	```yaml
124	vpc:
125	id: your-vpc-uuid
126	```
127
128	VPC CIDR whitelisting (recommended):
129	```bash
130	doctl vpcs get $VPC_ID --format IPRange # e.g., 10.126.0.0/20
131	doctl databases firewalls append $CLUSTER_ID --rule ip_addr:10.126.0.0/20
132	```
133
134	\| Setup \| Trusted Source Rule \|
135	\|-------\|---------------------\|
136	\| Public only \| `app:$APP_ID` \|
137	\| VPC enabled \| `ip_addr:<vpc-cidr>` \|
138
139	Critical: Bindable variables return PUBLIC hostnames even with VPC. Use private URLs:
140	```bash
141	doctl databases connection --private <cluster-id> --format URI
142	```
143
144	Full guide: See [vpc-trusted-sources.md](reference/vpc-trusted-sources.md)
145
146	---
147
148	## Reference Files
149
150	- [domains-dns.md](reference/domains-dns.md) — Domain types, DNS setup, wildcards, TLS, CAA
151	- [ingress-routing.md](reference/ingress-routing.md) — Path routing, rewrites, redirects, authority matching
152	- [cors-configuration.md](reference/cors-configuration.md) — CORS fields, patterns, credentials
153	- [vpc-trusted-sources.md](reference/vpc-trusted-sources.md) — VPC setup, trusted sources matrix, private URLs
154	- [static-ips-egress.md](reference/static-ips-egress.md) — Ingress IPs, dedicated egress, HTTP/2, internal ports
155	- [complete-patterns.md](reference/complete-patterns.md) — 5 complete architecture patterns
156
157	---
158
159	## Common Issues
160
161	\| Issue \| Fix \|
162	\|-------\|-----\|
163	\| Domain not resolving \| Check DNS records, allow 72h propagation \|
164	\| SSL certificate error \| Add CAA records for letsencrypt.org + pki.goog \|
165	\| CORS preflight fails \| Add OPTIONS to allow_methods \|
166	\| VPC connection refused \| Use VPC CIDR whitelisting, not app-based rules \|
167	\| Wrong component serves \| Reorder rules (specific first) \|
168
169	---
170
171	## Integration with Other Skills
172
173	- → designer: Add domains/ingress to app spec
174	- → troubleshooting: Debug DNS, CORS, VPC issues
175	- → postgres: VPC

People who liked this also viewed

6 picks

Type