Egress proxy

​

What the proxy reaches

• Exigo’s REST API: any subdomain of exigo.com, on port 443. The bare exigo.com host is refused.
• Exigo-hosted SQL replicas: port 1433, matched by the address the host name resolves to, not by the name itself. This covers Exigo’s own networks and Exigo’s shared Azure SQL server, including the aliases that point to it.

• A replica host name that doesn’t resolve to one of Exigo’s addresses is refused with a 403.
• The proxy refuses IP addresses as destinations. Connect to a host name and a port.

​

Before you start

• Your Mist app has a droplet attached. See Integration points.
• You’re an admin of the company that owns the droplet, or you use a company service token of that company.
• The Exigo tenant has allowlisted all four of Fluid’s egress addresses, for both the API and the SQL replica:

  Address	Used
  34.59.103.199	Now
  34.171.199.225	Now
  34.144.173.17	After the proxy moves to its new region
  34.174.57.210	After the proxy moves to its new region

  Fluid is moving the proxy to a new region, and the move has no date yet. Until it moves, Exigo sees only the first two addresses. Allowlist all four now, so calls keep working through the move. Fluid will update this page when the first two can be removed.

​

Turn on the egress proxy

• CLI, on an existing app: run fluid mist droplet egress-proxy on from the app’s folder, or pass the app’s slug: fluid mist droplet egress-proxy on spring-bonus.
• CLI, when you add the droplet: add --egress-proxy to fluid mist create with a droplet, or to fluid mist attach --kind droplet.
• Mist: check the egress option when you add or edit the droplet in the integration point dialog. The option shows when your company has it.
• Admin: open the droplet’s settings, and under Network Access, check Let this droplet reach external systems (e.g. Exigo) through Fluid’s egress proxy.

​

How long a change takes

• After you turn egress on, new connections can still be refused for up to a minute.
• After you turn egress off, new connections are refused within a minute.

​

Use the proxy from your app

import { createExigoRestClient } from "@fluid-app/exigo-connection-sdk/rest";
import { getExigoPool } from "@fluid-app/exigo-connection-sdk/sql";
import { resolveFluidInstallation } from "@/lib/fluid/installation-context";
// Defined once per app: see the SDK's "Define the credentials".
import { resolveExigoCredentials } from "@/lib/exigo";

// Authorize the caller first. See the warning below.
const { installation, companyId } = await resolveFluidInstallation(request);
const { rest, sql } = await resolveExigoCredentials(String(companyId));

const egressProxy = process.env.FLUID_EGRESS_PROXY_URL
  ? {
      url: process.env.FLUID_EGRESS_PROXY_URL,
      token: installation.authenticationToken,
    }
  : undefined;

const exigo = createExigoRestClient(rest, { egressProxy });
const pool = await getExigoPool(sql, { egressProxy });

Proxy-Authorization: Bearer dit_9XcT3vMq7LpW2nRb5KsZ8hJf

​

Local runs

​

When the proxy refuses

​

Related pages

• Exigo connection SDK: call Exigo’s API and query its SQL replica.
• Hosting: the environment variables Fluid sets on your app.
• Integration points: attach a droplet to your Mist app.