Networking

Give a machine a public IP so you can reach it from the internet, and control exactly which ports are open with a firewall allow-list.

Base URL: examples use $CLUNDRA_API as a placeholder for your Clundra API host.

Public-IP operations use the ips:read, ips:write, and ips:delete scopes — make sure your API key has them.

Expose a machine with a public IP

Attach a public IP and declare which ports should be reachable. Provide the SSH key(s) to authorize and the ports you want open:

curl -X POST $CLUNDRA_API/machines/$ID/public-ip \
  -H "X-API-Key: gopt_live_..." \
  -H "Content-Type: application/json" \
  -d '{ "sshKeyIds": ["KEYID"], "ports": [443] }'

Port 22 (SSH) is always allowed, so you can reach the machine even if you don't list it.

Check the public IP

See the machine's current public IP:

curl $CLUNDRA_API/machines/$ID/public-ip \
  -H "X-API-Key: gopt_live_..."

Returns null when no public IP is attached.

Firewall rules

The open ports are a firewall allow-list. Update it with a full replace — the ports you send become the complete set of allowed ports (anything not listed is closed):

curl -X PUT $CLUNDRA_API/machines/$ID/public-ip/rules \
  -H "X-API-Key: gopt_live_..." \
  -H "Content-Type: application/json" \
  -d '{ "ports": [443, 8080] }'

Port 22 is always forced in — you can't lock yourself out of SSH.
Port 25 (SMTP) is rejected.
Up to 64 ports total.

Detach the public IP

Remove the public IP when you no longer need the machine reachable from the internet:

curl -X DELETE $CLUNDRA_API/machines/$ID/public-ip \
  -H "X-API-Key: gopt_live_..."

Need help? support@gopilot.dev