Applications quickstart

Create an application that sends every request to your origin through a connector, serve it from a workload, and request it.

Last updated

View as Markdown Agent setup

This guide instructs you through serving your origin’s content from your first application.

  • Create a connector that reaches your origin over HTTPS.
  • Create an application.
  • Add a rule that sends every request to the connector.
  • Serve the application from a workload.
  • Send a request to the workload domain and get your origin’s answer.

Five parts make the chain, listed in the order this guide uses them:

  1. The connector holds the address of your origin and the way Azion connects to it.
  2. The application holds the rules that decide what happens to a request. A new application has no rules.
  3. The rule on the application pairs a criterion with a behavior. In this guide, the criterion matches every request, and the Set Connector behavior names the connector.
  4. The workload holds the domain that receives requests. Its deployment names the application.
  5. The request to the workload domain meets the rule, and the connector passes it to your origin.

A connector receives requests only once a rule names it, and an application only once a deployment names it.

On an application, you enable three Products: Cache, Application Accelerator, and Image Processor. A new application starts with Cache turned on and the other two turned off, and this guide changes none of them. To turn one on later, open the application’s Main Settings tab, turn on its switch in Modules, and select Save. The quickstart of each Product begins where this guide ends, with an application that already serves content.

The prerequisites and the five stages show the steps of one interface at a time. Select yours:

Prerequisites

  • An Azion account. For more information, refer to Create an account.
  • An origin server that answers HTTPS requests on port 443 under a public hostname. This guide writes that hostname as <your-origin-hostname>.
  • curl, to send a request through the workload.

You also need access to Azion Console. For more information, refer to Access Azion Console.

You also need the Azion CLI on your machine, authorized with a personal token.

You also need a personal token for the Authorization header. To create one, refer to Manage a personal token.

Create a connector to your origin

A connector holds the address of your origin and the settings Azion uses to reach it. You create it on its own, outside any application, and a rule names it later. This connector has one address and connects to your origin over HTTPS. It sends your origin’s hostname in the Host header.

To create the connector with the Azion CLI, put it in a JSON file first. Save this body as connector.json, and replace <your-origin-hostname> in both places:

JSON
01{
02 "name": "origin-connector",
03 "type": "http",
04 "attributes": {
05 "addresses": [
06 { "address": "<your-origin-hostname>" }
07 ],
08 "connection_options": {
09 "transport_policy": "force_https",
10 "host": "<your-origin-hostname>"
11 }
12 }
13}

addresses lists the origin servers, and connection_options.host is the Host header the connector sends. force_https makes every connection to the origin use HTTPS.

Create the connector from the file:

azion create connector --file connector.json

Record the ID of the new connector from the command output: the rule passes it as <connector-id>.

To create the connector with the API, send a POST request to the connectors endpoint. Replace [TOKEN VALUE] with your personal token, and <your-origin-hostname> with the hostname of your origin:

Shell
01curl --request POST \
02 --url https://api.azion.com/v4/workspace/connectors \
03 --header 'Accept: application/json' \
04 --header 'Authorization: Token [TOKEN VALUE]' \
05 --header 'Content-Type: application/json' \
06 --data {
07 "name": "origin-connector",
08 "type": "http",
09 "attributes": {
10 "addresses": [{ "address": "<your-origin-hostname>" }],
11 "connection_options": {
12 "transport_policy": "force_https",
13 "host": "<your-origin-hostname>"
14 }
15 }
16}

The response returns the connector, with a value for every setting the request left out. This excerpt shows those values:

JSON
01{
02 "state": "pending",
03 "data": {
04 "id": <connector-id>,
05 "name": "origin-connector",
06 "last_editor": "user@example.com",
07 …
08 "active": true,
09 …
10 "type": "http",
11 "attributes": {
12 "addresses": [
13 {
14 "active": true,
15 "address": "<your-origin-hostname>",
16 "http_port": 80,
17 "https_port": 443,
18 "modules": null
19 }
20 ],
21 "connection_options": {
22 "dns_resolution": "both",
23 "transport_policy": "force_https",
24 "http_version_policy": "http1_1",
25 "host": "<your-origin-hostname>",
26 "path_prefix": "",
27 "following_redirect": false,
28 "real_ip_header": "X-Real-IP",
29 "real_port_header": "X-Real-PORT"
30 },
31 "modules": {
32 "load_balancer": { "enabled": false, "config": null },
33 "origin_shield": { "enabled": false, "config": null }
34 }
35 },
36 …
37 }
38}

The connector is active, and its address takes HTTPS connections on https_port 443. Load Balancer and Origin Shield start turned off. Record the id: the rule passes it as <connector-id>.

To create the connector in Azion Console:

Open the Connectors page

Access Azion Console > Connectors.

Start a new connector
Name the connector

In General, enter origin-connector as the Name.

Select the HTTP type

In Connector Type, select the HTTP type.

Enter your origin's hostname as the address

Under Address Management, enter <your-origin-hostname> in Address, without a protocol or a port.

Send the same hostname in the Host header
Connect to the origin over HTTPS only

In Transport Protocol Policy, select the option that uses HTTPS only.

Select Create

The connector exists in your account, and the rule you add to the application selects it. For every field of the connector form, refer to Connectors.

Create the application

An application holds the rules that decide what happens to each request. It needs only a name, and every other setting keeps its default. Until a rule names a connector, the application has no origin to send requests to.

To create the application with the Azion CLI:

azion create application --name first-application --active true

The output carries the application’s ID:

Created Application with ID <application-id>

The application is active and has no rules. Cache and Functions start turned on, and Application Accelerator and Image Processor start turned off. Record the ID: the rule and the deployment pass it as <application-id>.

To create the application with the API, send a POST request to the applications endpoint. Replace [TOKEN VALUE] with your personal token:

Shell
01curl --request POST \
02 --url https://api.azion.com/v4/workspace/applications \
03 --header 'Accept: application/json' \
04 --header 'Authorization: Token [TOKEN VALUE]' \
05 --header 'Content-Type: application/json' \
06 --data '{"name": "first-application", "active": true}'

In the response, modules lists the switches the application starts with:

JSON
01{
02 "state": "pending",
03 "data": {
04 "id": <application-id>,
05 "name": "first-application",
06 "last_editor": "user@example.com",
07 …
08 "modules": {
09 "cache": { "enabled": true },
10 "functions": { "enabled": true },
11 "application_accelerator": { "enabled": false },
12 "image_processor": { "enabled": false }
13 },
14 "active": true,
15 "debug": false,
16 "product_version": "3.0",
17 …
18 }
19}

The application is active and has no rules. In modules, cache and functions start turned on, while application_accelerator and image_processor start turned off. Record the id: the rule and the deployment pass it as <application-id>.

To create the application in Azion Console:

Open the Applications page

Access Azion Console > Applications.

Start a new application
Name the application

In General, enter first-application as the Name.

Select Create

The application exists, and its Rules Engine tab holds no rules yet.

Send every request to the connector

A rule in Rules Engine for Applications pairs criteria with behaviors. This rule runs in the request phase. Its criterion, ${uri} starting with /, matches every request. Its behavior, Set Connector, sends each matching request to your connector. For more information, refer to Set Connector.

The criterion uses ${uri}, not ${request_uri}. ${request_uri} needs Application Accelerator turned on. On an application without it, the API refuses the rule with 400 and error 25047, Missing Required Modules.

To create the rule with the Azion CLI, keep the rule in a file: on a command line, the shell would expand ${uri}. Save this body as rule.json, and replace <connector-id> with the ID of your connector:

JSON
01{
02 "name": "send-to-origin",
03 "active": true,
04 "criteria": [
05 [
06 {
07 "variable": "${uri}",
08 "conditional": "if",
09 "operator": "starts_with",
10 "argument": "/"
11 }
12 ]
13 ],
14 "behaviors": [
15 {
16 "type": "set_connector",
17 "attributes": { "value": <connector-id> }
18 }
19 ]
20}

Each group in criteria opens with a condition whose conditional is if. Create the rule in the request phase of your application. Replace <application-id> with the ID of your application:

azion create rules-engine --application-id <application-id> --phase request --file rule.json

The output carries the rule’s ID:

Created Rules Engine with ID <rule-id>

The rule is active on your application, and it sends every request to your connector.

To create the rule with the API, keep the request body in a file: on a command line, the shell would expand ${uri}. Save this body as rule.json, and replace <connector-id> with the ID of your connector:

JSON
01{
02 "name": "send-to-origin",
03 "active": true,
04 "criteria": [
05 [
06 {
07 "variable": "${uri}",
08 "conditional": "if",
09 "operator": "starts_with",
10 "argument": "/"
11 }
12 ]
13 ],
14 "behaviors": [
15 {
16 "type": "set_connector",
17 "attributes": { "value": <connector-id> }
18 }
19 ]
20}

Each group in criteria opens with a condition whose conditional is if. Send a POST request to the request-phase rules of your application. Replace <application-id> with the ID of your application:

Shell
01curl --request POST \
02 --url https://api.azion.com/v4/workspace/applications/<application-id>/request_rules \
03 --header 'Accept: application/json' \
04 --header 'Authorization: Token [TOKEN VALUE]' \
05 --header 'Content-Type: application/json' \
06 --data @rule.json

The response carries the stored rule. This excerpt keeps its id, its criterion, its behavior, and its order:

JSON
01{
02 "state": "pending",
03 "data": {
04 "id": <rule-id>,
05 "name": "send-to-origin",
06 "active": true,
07 "criteria": [
08 [
09 {
10 "conditional": "if",
11 "variable": "${uri}",
12 "operator": "starts_with",
13 "argument": "/"
14 }
15 ]
16 ],
17 "behaviors": [
18 {
19 "type": "set_connector",
20 "attributes": { "value": <connector-id> }
21 }
22 ],
23 "description": "",
24 "order": 0,
25 …
26 }
27}

order is 0, the position of the first rule on the application. The rule is active, and it sends every request to your connector.

To create the rule in Azion Console:

Open the application

Access Azion Console > Applications, and select the application you created.

Select the Rules Engine tab
Select + Rule
Name the rule

In General, enter send-to-origin as the Name.

Select the request phase

In Phase, select Request Phase. A rule’s phase cannot change after you create the rule.

Set the criterion

Under Criteria, select the variable ${uri} and the operator starts_with, and enter / as the argument.

Select the Set Connector behavior

Under Behaviors, select Set Connector.

Select your connector

In Connector, select the connector you created.

Select Save

The rule appears in the Rules Engine tab, under the Request heading.

Serve the application from a workload

A workload holds what receives requests: the domain, the protocols, and the certificates. The application holds none of these settings. The workload’s deployment names the application it runs, and the current deployment is the one that serves requests. A new workload answers on a workload domain that Azion assigns under map.azionedge.net.

To create the workload with the Azion CLI:

azion create workload --name first-workload --active true

The output carries the workload’s ID:

Created Workload with ID <workload-id>

Create the deployment that names your application. Replace <workload-id> and <application-id>:

Shell
01azion create workload-deployment --workload-id <workload-id> \
02 --name first-deployment --application-id <application-id> \
03 --strategy-type default --active true --current true

The output carries the deployment’s ID:

Created Workload Deployment with ID <deployment-id>

--current true makes this deployment the one the workload serves. It names your application and no firewall.

To find the workload domain, describe the workload in JSON:

azion describe workload --workload-id <workload-id> --format json

The workload_domain field holds the domain that the final request goes to.

To create the workload with the API, send a POST request to the workloads endpoint. infrastructure set to 1 selects the production infrastructure, and workload_domain_allow_access set to true lets the workload answer on its workload domain:

Shell
01curl --request POST \
02 --url https://api.azion.com/v4/workspace/workloads \
03 --header 'Accept: application/json' \
04 --header 'Authorization: Token [TOKEN VALUE]' \
05 --header 'Content-Type: application/json' \
06 --data {
07 "name": "first-workload",
08 "active": true,
09 "infrastructure": 1,
10 "workload_domain_allow_access": true
11}

The response carries the starting settings of the workload and the domain Azion assigned to it:

JSON
01{
02 "state": "pending",
03 "data": {
04 "id": <workload-id>,
05 "name": "first-workload",
06 "active": true,
07 …
08 "infrastructure": 1,
09 "tls": {
10 "certificate": null,
11 "ciphers": 7,
12 "minimum_version": "tls_1_3"
13 },
14 "protocols": {
15 "http": {
16 "versions": ["http1", "http2", "http3"],
17 "http_ports": [80],
18 "https_ports": [443],
19 "quic_ports": [443]
20 }
21 },
22 …
23 "domains": [],
24 "workload_domain_allow_access": true,
25 "workload_domain": "<your-workload-domain>",
26 "product_version": "1.0"
27 }
28}

The workload has no domains of its own, and workload_domain holds the one Azion assigned. Record the id and the workload_domain.

Create the deployment that names your application. Send a POST request to the deployments of your workload, and replace <workload-id> and <application-id>:

Shell
01curl --request POST \
02 --url https://api.azion.com/v4/workspace/workloads/<workload-id>/deployments \
03 --header 'Accept: application/json' \
04 --header 'Authorization: Token [TOKEN VALUE]' \
05 --header 'Content-Type: application/json' \
06 --data {
07 "name": "first-deployment",
08 "current": true,
09 "active": true,
10 "strategy": {
11 "type": "default",
12 "attributes": {
13 "application": <application-id>
14 }
15 }
16}

The response returns the new deployment, with your application in strategy.attributes. current set to true makes it the deployment the workload serves.

To create the workload and its deployment in Azion Console:

Open the Workloads page

Access Azion Console > Workloads.

Start a new workload

The Create Workload page opens.

Name the workload

Enter a name, such as first-workload.

Select your application

Under Deployment Settings, set Application to the application you created.

Leave Firewall and Custom Page empty
Select Create Workload

The workload exists, and its deployment names your application. To copy the address that the final request goes to, select Copy Workload URL.

Send a request through the workload

This stage needs only curl, whichever interface you used to build the chain. In the command, replace <your-workload-domain> with the workload domain of the workload you created.

A new workload does not answer at once. Its first deployment can take several minutes to reach traffic, and no duration is guaranteed. Until then, the workload domain answers 404 with a placeholder page. While the deployment spreads, answers to the same request can alternate between that 404 and your origin’s response. Repeat the request until the answer comes from your origin.

Send a request to the root path of your workload domain:

curl -i https://<your-workload-domain>/

The response is the one your origin returns for /: its status, its headers, and its body. Every other path reaches your origin the same way, because the rule matches every URI that starts with /. Your application now sends every request on its workload domain to your origin through the connector.

Next steps

Cache quickstartCreate a cache setting, apply it to one path with a rule, and read whether a response came from cache.Application Accelerator quickstartTurn on Application Accelerator and cache a listing that varies by a query string argument.Image Processor quickstartTurn on Image Processor, give each transformation its own cache entry, and request your first derived image.Rules Engine for ApplicationsThe phases, variables, operators, and behaviors a rule on an application accepts, Set Connector among them.How Applications worksHow a request moves from a workload through the rules of an application to an origin.Applications limitsThe bounds on an application and on the Products enabled on it.