Circuits

What is a Circuit?

A circuit is the fundamental unit of Horizon's access control model. It represents a managed, policy-enforced connection between a publicly accessible domain on the internet and a specific service running on or accessible through an agent-connected device on a private network. Creating a circuit establishes a mapping between an internal service endpoint (defined by an agent, IP address, and port) and a publicly accessible HTTPS domain, together with the access policies and security rules that govern traffic to that service. The platform responds by assigning the circuit a unique, auto-generated public domain in the format {prefix}.horizon.mutexercloud.com, where the prefix is a system-generated identifier that is unique to that circuit. From that point forward, any traffic that arrives at that domain is handled by the Horizon proxy, subjected to the circuit's configured security rules and access policies, and - if allowed - forwarded through the agent to the backend service. The term "circuit" is used rather than "route" or "endpoint" to emphasize that this is more than just a network mapping. A circuit encompasses the entire configuration: the routing information (agent, IP, port, protocol), the access policy (who can connect), the security rules (IP filtering, country blocking, bot detection), the lifecycle settings (enable/disable, expiration), and the observability data (request logs, access logs). Each circuit is a fully self-contained, independently managed trust boundary.

Circuit Properties

Every circuit has the following properties, which are set at creation time or configured through the settings panel afterward. The Name is a human-readable identifier for the circuit, used in the connections table and logs to distinguish between multiple circuits in a project - it must contain only letters, numbers, spaces, and hyphens. The Agent specifies which device agent will receive the proxied traffic and forward it to the backend service - this must be an agent in the current project that has network connectivity to the target service. The IP Address is the internal IPv4 address of the target service, as seen from the agent's network (for example, 192.168.1.100 if the service is on the agent's local network, or 127.0.0.1 if it is running directly on the agent device). The Port is the TCP port the target service listens on, which must be a number between 1 and 65535. The Protocol determines whether the Horizon proxy communicates with the backend service over HTTP or HTTPS - this should match whatever protocol the backend service actually uses. When HTTPS is selected, the operating system on the agent device must be able to verify the backend service's TLS certificate. If the backend service uses a certificate issued by a private or internal Certificate Authority (CA), that CA's root certificate must be installed in the agent device's trust store. For instructions on installing custom CA certificates on Ubuntu, see Custom CA Certificates. The Domain is the auto-generated public URL ({prefix}.horizon.mutexercloud.com) that is assigned at creation and cannot be changed or customized. The Access Policy determines who can reach the circuit (Public, Project Members, or Specific Users). The Enabled/Disabled toggle controls whether the circuit is actively serving traffic. The Expiration is an optional date and time (in UTC) after which the circuit is automatically deleted.

Circuit Lifecycle

A circuit progresses through several states over its lifetime. When first Created, the name, agent, IP, port, protocol, and initial access policy have been configured, and the platform has assigned a unique domain. The circuit immediately becomes Active - it is enabled, the domain resolves, and traffic is proxied to the backend service with all configured policies enforced. At any point, the circuit can be Disabled by toggling the enabled switch. When disabled, the circuit still exists with all its configuration intact, but the domain stops serving traffic and no new log entries are generated - this is useful for maintenance windows or temporary shutdowns without losing the existing configuration. If an expiration date was set, the circuit enters the Expired state when that date is reached, at which point it is automatically deleted along with all its configuration and associated data. The expiration is accurate to approximately 5 minutes, meaning the circuit may remain active for a brief period after the nominal expiration time. Finally, a circuit can be Deleted manually at any time through the settings interface. Deletion is permanent and cannot be undone - the domain ceases to resolve, and all associated configuration (IP rules, country blocks, allowed users) and log data is removed.

Circuit Limits

Each circuit is bound to exactly one agent and one backend target (IP and port). However, multiple circuits can target the same device - for example, one circuit may point to a Grafana dashboard on port 3000 and another to a device management API on port 8080, both routed through the same agent. Domain names are permanent for the life of the circuit and cannot be changed or customized. To obtain a different domain, the circuit must be deleted and a new one created (which will receive a new auto-generated domain). Core routing properties - the agent, IP address, port, and protocol - are set at creation time and cannot be modified afterward. If any of these need to change, the circuit must be deleted and recreated. Access policies, security rules, and expiration can be modified at any time on an active circuit.

WARNING

Deleting a circuit cannot be undone. The domain will permanently stop resolving, and all associated policy configuration, allowed user lists, IP rules, country blocks, and log data will be removed.