Baran.
Production-grade HTTPS ingress for Acurast jobs.
A stable public URL for code sealed inside attested compute — without the operator ever seeing your traffic.
Private Alpha Available by invitation; APIs and pricing may change.
01 — The problem
Acurast's confidential compute
can't be reached.
Attested compute seals your code on real hardware — but gives it no public URL the world can reach, not while keeping the one rule that makes it confidential: TLS only ever terminates inside the enclave. Three things make that genuinely hard:
01 · network
Phones are behind NAT
Behind home routers and carrier NAT — direct inbound from the public internet doesn't work.
02 · enclave
The seal constrains the runtime
The runtime is locked down — you can't just app.listen() and expose a port.
03 · trust
Identity without trusting operators
Someone must terminate TLS and own the cert. If that's the operator, confidentiality is gone.
02 — Transport
Two ways through.
A processor behind NAT can't take a direct connection. There are two ways to move bytes to it anyway — and Baran runs both, so no processor class is off the table.
Reverse tunneling
Works behind any NATThe processor dials out and holds the tunnel open; traffic rides back down it. Works anywhere outbound internet does — even deep behind carrier NAT.
Forward addressing
Direct · lowest latencyA public gateway routes callers straight in by server name — admitted by a cryptographic ceremony, with no extra hop.
03 — The innovation
Moving bytes is the easy part.
Six more pieces make it enterprise-grade.
Each closes a gap where "just trust the operator" would otherwise creep back in — exactly what an enterprise needs to ship in production. Baran built all six.
Platform minted hostnames
One signed quote per name — one deployment.
Customer-domain TLS
Born inside the enclave — and never leaves.
Multi-operator admission
A ceremony picks each route's carrier — with failover.
Payment & capacity
USDC escrow, released per uptime-minute to the operator and validators.
Independent verification
Validators prove it served — and that gates payment.
Developer experience
Your app, one line to deploy.
04 — How it works
Bytes in, plaintext never out.
A request reaches your app over a path where no one in the middle can read it. The gateway routes by server name at layer 4 and passes encrypted bytes straight through to TLS that terminates inside the enclave.
The operator never sees plaintext. It carries encrypted bytes between the public internet and the processor — across NAT or direct. TLS only ever terminates inside the sealed enclave, where the key was born and stays.
05 — Proven, then paid
Proven, then paid.
Funds are escrowed up front — but a route only earns once attested validators have signed that it was actually serving. Proof is the gate on the money, and escrow releases per proven minute.
No proof, no pay. Validators run attested code themselves and probe the live route; their signed quorum is what opens the gate. Operators and validators are paid in USDC — a stablecoin, dollars in and dollars out — for each minute that was proven.
06 — Deploy
Three commands to live.
Install the PROOF CLI, scaffold a project, check the quote, and ship. DNS, certificates, and routing are handled for you.
hello.ingress.works
Give your job a front door.
The full walkthrough, CLI reference, and concepts live in the docs.
Read the docs →