Skip to content
main-compute

Network

Private connectivity

Private tunnel, egress allow-list and firewall-lock options for Enterprise inference.

Updated 2026-10-27 · MainAI Compute docs

Inference runs behind a private network by default. You call the API; model hosts have no public model port and their addresses are never part of the API contract. Enterprise contracts can add a stricter customer-side path without changing the SDK, model IDs or request bodies.

PathsLink to this section

Public HTTPS

Customer setup
None; use the documented base URL
Typical fit
Fastest start and standard server-to-server calls

Private tunnel

Customer setup
WireGuard or IPsec endpoint in your VPC or office
Typical fit
Traffic that must avoid the public ingress

Firewall lock

Customer setup
Allow only agreed static egress addresses; optional mutual TLS
Typical fit
A tight network policy with no tunnel
The public API path is the default. Tunnels and firewall locks are contractual Enterprise options.

Private tunnelLink to this section

A tunnel connects your network to the inference endpoint over WireGuard or IPsec. MainAI and your network engineer agree the address plan, keep-alives, failover and who owns each side before activation.

  • No inbound public connection is required from your network.
  • The tunnel carries API traffic only; portal access stays on HTTPS unless separately agreed.
  • A tunnel failure fails closed at the API boundary. The contract records the agreed retry and escalation path.
  • Rotate tunnel keys through the named technical contacts, not a support queue.

Egress allow-list and firewall lockLink to this section

If a tunnel is not practical, MainAI can give your team a small set of static egress addresses for an outbound allow-list. Mutual TLS can be required as a second factor. The addresses are exchanged before cutover and changes use the contract notice period.

  • The allow-list is enforced on the customer side; billing and KYC gates still apply on every call.
  • Do not pin model-host addresses. Public model IDs are the stable contract.
  • Keep the API egress set current in your firewall; a stale set looks like an outage.
  • Optional mTLS client certificates are issued to a named organisation and can be revoked independently.

What does not changeLink to this section

Authentication, models, streaming, errors, limits, pricing and metering work exactly as documented. Only the network path and DNS endpoint can differ. The OpenAI-compatible client configuration stays the same.

bash
# The base URL is supplied in the contract for a private path.
curl -s "$MAINAI_PRIVATE_BASE_URL/models" \
  -H "Authorization: Bearer $MAINAI_API_KEY"

Failure behaviourLink to this section

Tunnel down

Result
Calls fail at the path; retry once the tunnel recovers.

Source outside the allow-list

Result
Blocked before the API; add the new address or contact your technical owner.

Certificate expired or revoked

Result
TLS handshake fails; rotate the certificate through the named contacts.

Model pool unavailable

Result
503 upstream_unavailable; the public API contract still applies.

Requesting a private pathLink to this section

  1. 01

    Raise it in the technical call

    Name the tunnel or firewall option, the networks involved and the required DNS name.

  2. 02

    Agree the design

    Owners, address plan or egress set, certificates if used, failover and change notice.

  3. 03

    Record it in the contract

    The private path and endpoint become part of the signed scope before activation.

  4. 04

    Verify before cutover

    Both sides prove connectivity, authentication, failover and rollback from a test client.