Workspace URLs and routing

Workspace URLs section — The External URLs section of the workspace form, showing a subdomain, domain, port, and the authentication selector.

A workspace can expose the HTTP services running inside its container at public URLs. Each URL maps a host name (subdomain.domain) and a container port to a browser-reachable address, optionally over TLS and optionally protected by authentication. You add URLs when you create or edit a workspace, in the External URLs section.

Trailer serves a workspace URL in one of two ways. Which one is used is decided automatically from the URL’s host. You do not pick it directly.

The two routing modes

Agent proxy

When a URL’s host is under the Trailer server’s own host (a subdomain of the server’s domain), the URL points back at the server itself. The server relays each request to the agent over the connection the agent already holds open, and the agent forwards it into the container. The reply travels back the same way.

This needs no reverse proxy on the host and no DNS beyond a subdomain that resolves to the server. It works out of the box, which makes it the simplest way to reach a workspace. The tradeoff is that traffic flows through the server rather than going straight to the host.

Traefik reverse proxy

When a URL uses a domain that is routed to the workspace’s host, a reverse proxy running on that host routes the request straight to the container. The server is not in the data path. This needs a domain pointed at the host and a reverse proxy configured there, and it supports its own TLS certificate issuance. See Traefik routing for the details.

How the mode is chosen

You choose the mode indirectly, by picking the URL’s domain:

A domain under the Trailer server’s own host is served through the agent proxy.
A domain that resolves to the workspace’s host (with a reverse proxy configured on that host) is served through Traefik.

Each URL is evaluated on its own, so a single workspace can have some URLs served through the agent proxy and others through Traefik at the same time.

	Agent proxy	Traefik
Setup required	None	Domain pointed at the host, plus a reverse proxy on the host
Data path	Through the server	Directly from the host to the container
DNS	A subdomain of the server’s host	A domain that resolves to the workspace’s host
Best for	Quick access, single-host setups	Many hosts, custom domains, higher traffic

Authentication

Independently of the routing mode, each URL has an access level:

Public: no authentication. Anyone with the URL can reach the service.
Basic: HTTP basic authentication with a username and password.
Internal: only signed-in Trailer users who have access to the workspace can reach the URL.