orchestra ← Archive Lab

ORCHESTRA / NETWORK LAB SIMULATION · NO LIVE TRAFFIC

mTLS gives the machines an ID.

Follow one private request from your browser to the processing service. Then break a link and see exactly where it stops.

Two connections, two jobs. Cloudflare Tunnel reaches the site gateway. A separate direct mTLS bridge protects calls from that gateway to conductor.

THE REQUEST ROUTE

One request. Four stops.

READY TO TRACE
  1. CLIENTYour browserPrivate video or API request WAITING
  2. HTTPS
  3. PUBLIC EDGECloudflareWorker routes the request WAITING
  4. TUNNEL · 7844
  5. SITE GATEWAYconductor-devWebsite and request relay WAITING
  6. mTLS · 443
  7. PROCESSINGconductorPrivate API, media and state WAITING

Port 7844 is an outbound connector from conductor-dev to Cloudflare. Port 443 is the separate direct hop from the gateway to conductor.

SIMULATION READY

Choose a scenario, then run it.

The animation is local to this page. No packet, API request or video leaves your browser.

  1. 01Browser sends HTTPSWAITING
  2. 02Cloudflare reaches the gatewayWAITING
  3. 03Gateway opens direct TCP 443WAITING
  4. 04Both machine certificates are checkedWAITING
  5. 05Service checks the visitor sessionWAITING

THREE DIFFERENT CHECKS

Each layer solves a different problem.

01

PUBLIC ORIGIN

Cloudflare Tunnel

conductor-dev keeps an outbound connector to Cloudflare on TCP or UDP 7844. This lets Cloudflare reach the site gateway without opening an inbound port there.

02

PRIVATE NETWORK HOP

Direct TCP 443

The gateway reaches conductor over a separate direct connection. The network must allow it; mTLS does not open a blocked port.

03

MACHINE + USER IDENTITY

mTLS, then sign-in

mTLS checks both service certificates and encrypts their connection. The application then checks whether the visitor has a valid session or API key.