orchestra ← Archive Lab

ORCHESTRA / PACKET PATH SIMULATION · NO LIVE TRAFFIC

A request goes out.
Video comes back.

A browser reaches the public edge. The site gateway relays a private request over the direct mTLS bridge. Then the stream returns along the same route.

Two separate network legs. The origin tunnel connects outward to Cloudflare. The gateway’s mTLS bridge connects directly to the processing service.

REQUEST ROUTE / RETURN STREAM

One path, two directions.

READY TO TRACE
REQUEST → ← RESPONSEILLUSTRATIVE · NO MEASURED SPEEDSWIPE ROUTE →
Simulated Orchestra request route and returning video stream A browser connects to Cloudflare over HTTPS. The origin tunnel from the site gateway connects outward to Cloudflare on port 7844. The gateway reaches the private service directly over mutually authenticated TLS on TCP 443. Synthetic response packets return to the browser. HTTPS CLOUDFLARETUNNEL · 7844 DIRECT mTLSTCP 443 CLIENTBrowser PUBLIC EDGECloudflare SITE GATEWAYconductor-dev PRIVATE SERVICEconductor OUTBOUND CONNECTOR STARTS AT THE GATEWAY Video chunks return over the established path SYNTHETIC ROUTE · NO VIDEO, CREDENTIALS, LIVE TELEMETRY OR BANDWIDTH TEST
Browser ↔ public edge Outbound origin tunnel · 7844 Direct machine bridge · mTLS on 443
TRACE

Each gate has a different job.

READY · 0 / 5
  1. 01
    Reach the site gatewayCloudflare routes through its outbound tunnel.
    WAITING
  2. 02
    Open the direct TCP pathPort 443 must be reachable before TLS begins.
    WAITING
  3. 03
    Verify both machine identitiesEach service checks the other’s certificate.
    WAITING
  4. 04
    Authorize the visitorThe app checks a separate session or API key.
    WAITING
  5. 05
    Return the responseGenerated video chunks travel back along the route.
    WAITING

SIMULATION READY

Pick a scenario and run the stream.

This page draws a fictional route in your browser. It sends no requests to Orchestra services.

WHY mTLS?

An open port is a route.
A certificate proves who arrived.

TCP makes a connection possible. mTLS encrypts that direct hop and lets both machines verify each other. The application still checks the visitor separately.

01 / ROUTETCP 443

Firewall and routing rules must let the machines connect.

02 / MACHINE IDmTLS

Both service certificates must be trusted before private data crosses.

03 / USER ACCESSSession or key

The app decides whether this visitor can read the requested resource.