If your website or application runs in our container hosting, you can put ShieldCache directly in front of it - with firewall, cache, rate limits and all other features. You do not need your own server or help from support. The panel shows you what to do in both places.
Step 1: Read the origin in the container
Open your container project, select the container and the Reachability tab. Below every web address and every own TCP port you will find the line Usable as ShieldCache origin:
- Web address (recommended):
https://<name>-<project>.apps…- ShieldCache connects encrypted via port 443 and sends the name of the container as host header. This is how our app server knows which container is meant. - Own TCP port: address and port, for example
203.0.113.10:20016. Only the public container ports from the Reachability tab are allowed, no other ports of the app server. If the line is missing for a port, use the web address.
The copy button puts the origin on the clipboard. If you already have ShieldCache, Use in ShieldCache takes you straight to your project; without ShieldCache it says Order ShieldCache.
Step 2: Add or choose a site
After clicking Use in ShieldCache, the ShieldCache project shows the note “Use the origin from your container hosting”. Open an existing site or add a new one with Add site. You land in the Origin tab with address, port, TLS and host header pre-filled. Check the values and click Save, then Apply as usual.
For a TCP port, “Connect encrypted” is off at first. If your application speaks HTTPS on this port, switch it on. Use Test origin to check that ShieldCache reaches your container. How to switch your domain to ShieldCache is described in First steps.
IP filter: allow the proxy
If your web address has an IP allowlist or your TCP port is set to Only certain IP addresses, the container only accepts these addresses. ShieldCache connects to your container from its own addresses - if they are missing from the list, visitors see an error page (usually SC-502-URSPRUNG or SC-504-ZEIT).
Step 3: Allow the ShieldCache proxy in the container
You do not need to know the addresses of the proxy. There are three ways:
- In the Origin tab of the ShieldCache site, a note warns you if the origin is your own container and its IP filter does not allow the proxy. Allow proxy in the container adds the addresses after a confirmation.
- The Reachability tab of the container shows the same note with the button Allow proxy.
- When editing a reachability entry, Allow ShieldCache proxy adds the addresses to the list of allowed addresses.
Your other entries remain. If an address is reachable by everyone, the proxy does not need to be allowed. To allow it, you need the right to manage containers.
Good to know
- Link at a glance: If one of your ShieldCache sites uses the container, the Reachability tab says “Used by ShieldCache site …” with a link to the site.
- Visitor IP: Your container sees the address of ShieldCache. The real visitor IP is in
X-Forwarded-FororX-Real-IP(see Setting up the origin server). In your application, only trust the ShieldCache proxy. - Error “own infrastructure”: Other ports of the app server are not allowed as an origin. Use the public container port from the Reachability tab or the HTTPS address of the container.
Web address or TCP port - which should I use?
The web address. It is encrypted, has a valid certificate and keeps working if you later bind the container to a different port. Use the TCP port if your application has no web address or delivers its own certificate.
Should my container only be reachable through ShieldCache?
That is recommended so that nobody bypasses the firewall: set access to “Only certain IP addresses” and only allow the ShieldCache proxy (and your office if needed).
I do not see the line “Usable as ShieldCache origin”.
It appears for web addresses and own TCP ports, not for UDP. An own domain only appears after the proof of ownership. For TCP ports, the tab shows a note if the port is not released as an origin - then use the web address.