Remote endpoints through a Nanite

Some systems only accept connections from inside your own network. Tealfabric cannot open that connection. A Tealfabric Nanite is a small program you run next to that system. The Nanite dials out to Tealfabric and holds a secure session. When an integration is set to use that Nanite, Tealfabric sends the HTTP call down the session. The Nanite performs the call and returns the response.

ProcessFlow and agents keep using the integration the same way they do today. You do not add a new tool name.

What you configure

Nanites and integrations are separate screens.

One Nanite can serve several integrations. Those integrations can describe different systems, as long as each host is on that Nanite’s allowlist. Leaving the Nanite field empty means Tealfabric calls the endpoint directly.

The first connector that can use a Nanite is the generic REST API connector. Other connectors omit the Nanite field until they can send a prepared HTTP call.

Create a Nanite

1. Open Nanites and create a record. Add each destination as scheme, host, and port. The Nanite refuses every host that is not on this list.
2. Copy the install snippet when it appears. The enrollment token is shown once. Tealfabric keeps only a hash of that token. The token expires after 15 minutes.
3. On a machine that can reach the private endpoint, run that snippet with the Tealfabric Nanite installer. The machine needs outbound access to Tealfabric on port 443. It does not need an inbound port.
4. The Nanites screen shows Connected after the Nanite enrolls. It then renews its own credential. You do not file a ticket for that renewal.

The installer and the Alpine host, including weekly package upgrades, are part of the Nanite application. Upgrades wait until the Nanite is not in the middle of a call. The enrollment and the allowlist remain on disk across those upgrades.

A corporate TLS inspection proxy can be added with the installer’s CA file. Ask your network administrator for that PEM. The Nanite still checks the Tealfabric hostname.

Use it on an integration

1. Create or open an integration that uses the generic REST API connector.
2. Choose the Nanite, or leave Direct from Tealfabric selected.
3. Put the private base URL in the connector settings, the same way you would for a public URL.
4. Run the integration test. The test goes through the Nanite when one is selected.

Clearing the Nanite field returns that integration to a direct call. Revoking a Nanite does not delete the integrations that point at it. Those calls fail until you clear the field or the Nanite enrolls again.

If the Nanite is offline, the call fails immediately. Tealfabric does not try the same URL from the platform network instead. You also get one notification when the Nanite disconnects.

Limits that affect a call

• Only http and https URLs are forwarded.
• A redirect is returned as the response. The Nanite does not follow it to another host.
• The Nanite handles a limited number of calls at once. Extra calls fail with a busy result. The default is 4, and a Nanite can be raised up to 16.
• Very large bodies are rejected instead of being buffered without a limit.

Two sites

Each site has its own Nanite, its own enrollment token, and its own allowlist. Two organizations on one machine are two installs, each with its own data directory.