> ## Documentation Index
> Fetch the complete documentation index at: https://engineering.unkey.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Overview

> Multi-tenant ingress and gateway: TLS termination, policy enforcement, and routing to deployment instances

Frontline is Unkey's multi-tenant ingress and gateway. It is the first Unkey-owned hop for inbound traffic and the boundary where every request is authenticated, rate limited, and routed before it reaches a customer's deployment.

Frontline runs as a regional, multi-tenant edge service. A single fleet serves all workspaces and environments in a region. There is no per-environment proxy: Frontline owns the request path end to end, from TLS termination to the deployment instance.

## Responsibilities

* Terminate TLS for apex and custom domains using SNI, and redirect plain HTTP to HTTPS.
* Resolve the request hostname to a deployment using control-plane data in MySQL, with short-lived routing and certificate caches to avoid a round trip on every request.
* Evaluate the deployment's policies (KeyAuth, rate limiting, firewall, OpenAPI validation) before proxying. A request that fails a policy receives a structured error and never reaches the instance.
* Select a healthy instance of the deployment in the same region and proxy the request directly, streaming the response back. When no local instance exists, forward to a peer Frontline in another region.
* Strip any client-supplied `X-Unkey-Principal` header and set the verified principal after authentication, so downstream code can trust it.
* Record request telemetry to ClickHouse and expose Prometheus metrics.

## Architecture position

```
Client (HTTPS)
     │
     ▼
Frontline (regional, multi-tenant)
  TLS termination, hostname routing,
  policy evaluation, instance selection
     │
     ▼
Instance (customer workload)
```

Routing decisions come from control-plane data stored in MySQL. When the local region has no healthy instance for the target deployment, Frontline forwards the request to a peer Frontline in a region that does, preserving TLS termination and routing consistency.

## Runtime subsystems

Frontline embeds the subsystems policy execution needs. Rate limit policies use Unkey's [rate limiting](/architecture/ratelimiting/overview) service rather than a Frontline-owned counter implementation.

## Related pages

* [Ingress](/architecture/services/frontline/ingress) for TLS termination, hostname resolution, and cross-region routing
* [Routing](/architecture/services/frontline/routing) for instance selection and failover
* [Request flow](/architecture/services/frontline/request-flow) for the full lifecycle of a proxied request
* [Policies](/architecture/services/frontline/policies/index) for the policy engine
* [Configuration](/architecture/services/frontline/configuration) for config fields and defaults