Skip to main content
Frontline routes a request by looking up its hostname, selecting a healthy instance of the target deployment, and proxying locally or forwarding to another region. Key components:

​
Flow: route request

​
Routing decisions

Frontline uses deployment state and regional proximity to select a destination.
  • Frontline looks up the route by FQDN in the database and parses the deployment’s policies.
  • If the deployment has a running instance in the current region, it proxies locally, trying instances in shuffled order.
  • If not, it selects the nearest region with a running instance using the region proximity list.

​
Cross-region forwarding

When forwarding to another region, Frontline targets:
The original hostname is preserved so the remote Frontline can perform TLS termination, policy evaluation, and instance selection. Frontline sends X-Unkey-Frontline-Meta to the peer. The header contains an PASETO v4.public token with an expiry time and an ordered hop history. Each hop contains the region, request ID, Frontline ID, and forward time as Unix milliseconds. The complete header value cannot exceed 4,096 bytes. The following flow shows how Frontline handles the metadata.

​
Hop limits

Frontline enforces a maximum hop count to prevent routing loops. The signed X-Unkey-Frontline-Meta header carries the hop history. The history length is the hop count. Frontline rejects a cross-region forward when the length reaches max_hops. It preserves duplicate regions because they show routing loops. Frontline appends the current hop, replaces the token, and sets the expiry to 1 minute in the future on each forward. Frontline removes invalid metadata and treats it as absent for all requests. This rule prevents a client-controlled header from blocking service.

​
TLS certificate selection

Frontline selects TLS certificates per SNI. It attempts an exact hostname match first, then falls back to the immediate wildcard (for example *.example.com). If no certificate is found, the TLS handshake falls back to a default certificate.