Creating a Connection

Prerequisites

Before creating a connection (circuit) in Horizon, several prerequisites must be in place. The user must be an authenticated member of the project's environment in which the circuit will be created - Horizon operates at the project level, and only project members can create and manage circuits. The project must have at least one device with an active Mutexer Agent connected and online. The Agent is the bridge between the Horizon proxy and the services on the private network; without an active Agent, there is no path for traffic to reach the backend service. The service to be exposed must be running and accessible from the Agent's network - meaning the Agent device must be able to reach the target IP address and port over its local network. If the service is running directly on the Agent device itself, the IP address will typically be 127.0.0.1 (localhost). If the service is running on a different device on the same network, the IP address will be that device's local network address (for example, 192.168.1.100). Verify connectivity before creating the circuit by confirming that the target service is reachable from the Agent device - for example, by running curl http://192.168.1.100:8080 from the Agent's command line. Finally, the protocol used by the backend service must be known: HTTP or HTTPS. Most industrial devices and local services use plain HTTP, but some may have their own TLS configuration and require HTTPS.

INFO

If the backend service protocol is unknown, select HTTP first. The vast majority of local services on industrial devices and edge hardware serve plain HTTP. The circuit can be deleted and recreated with HTTPS if the initial configuration does not work.

Step-by-Step

To create a new connection, navigate to the Horizon settings panel within the project settings tab. The connections management interface displays any existing circuits in a table and provides a button to create a new connection. Click the Create Connection button to open the creation form.

In the Name field, enter a human-readable name for the circuit. This name is used in the connections table and in log entries to identify the circuit. Choose a descriptive name - for example, "Grafana Dashboard - Building A" or "PLC Config Panel - Line 3". The name must contain only letters, numbers, spaces, and hyphens, and must be between 1 and 50 characters in length.

In the Agent dropdown, select the agent that has network access to the backend service to be exposed. The dropdown lists all agents currently registered in the project. Only agents that are online and connected will be able to serve traffic, though an offline agent can be selected and the circuit will become functional once the agent comes online.

In the IP Address field, enter the IPv4 address of the backend service as seen from the agent's network. If the service runs directly on the agent device, enter 127.0.0.1. If it runs on another device on the same local network, enter that device's IP address. The field accepts any valid IPv4 address in dotted-decimal notation.

In the Port field, enter the TCP port number that the backend service listens on. This must be a number between 1 and 65535. Common ports include 80 (HTTP), 443 (HTTPS), 3000 (Grafana), 8080 (various web services), and 1880 (Node-RED), but the service may use any port.

In the Protocol selector, choose either HTTP or HTTPS, depending on what protocol the backend service speaks. This determines how the Horizon proxy communicates with the backend through the Agent - it does not affect the public-facing side, which always uses HTTPS. If the backend serves plain HTTP (the most common case for local services), select HTTP. If the backend has its own TLS certificate and requires HTTPS connections, select HTTPS.

In the Access Policy selector, choose the initial access policy for the circuit. The available options are Public (no authentication required), Project Members (requires Mutexer authentication and project membership), or Specific Users (requires authentication, membership, and an explicit email allowlist). See the Access Policies page for a detailed explanation of each tier. If Specific Users is selected, email addresses can be added to the allowlist after the circuit is created.

Optionally, set an Expiration date and time for the circuit to automatically self-destruct after a certain point. This is useful for temporary access grants, demo environments, or time-limited vendor access. The expiration is specified in UTC and is accurate to approximately 5 minutes. If no expiration is set, the circuit remains active indefinitely until manually deleted or disabled.

Once all fields are completed, click Create to provision the circuit. The platform will validate the form inputs, assign a unique domain under *.horizon.mutexercloud.com, and activate the circuit. The circuit's settings page is then displayed, showing the assigned domain and providing access to configure additional security rules (IP filtering, country blocking) and manage the allowed users list if using the Specific Users policy.

Form Validation Rules

The creation form enforces several validation rules to ensure circuits are configured correctly. The Name field must be between 1 and 50 characters and may only contain letters (a-z, A-Z), numbers (0-9), spaces, and hyphens - special characters, underscores, and other symbols are not permitted. The Agent field must have a valid agent selected from the dropdown; a circuit cannot be created without associating it with an agent. The IP Address must be a valid IPv4 address in standard dotted-decimal notation (e.g., 192.168.1.1); IPv6 addresses, hostnames, and URLs are not accepted. The Port must be an integer between 1 and 65535 inclusive. The Protocol must be either HTTP or HTTPS. The Access Policy must be one of the three available tiers. The Expiration, if provided, must be a date and time in the future - an expiration in the past is not accepted. If any validation rule fails, the form will display an error message indicating which field needs to be corrected, and the circuit will not be created until all fields pass validation.

After Creation

Once the circuit is created, the assigned domain becomes active immediately. The circuit is accessible by navigating to the domain displayed on the circuit's settings page, in the format https://{prefix}.horizon.mutexercloud.com. If the access policy is set to Project Members or Specific Users, an authentication prompt is presented when the domain is first visited. The circuit's settings page also provides access to the full range of security configuration options, including IP blacklist and whitelist rules using CIDR notation, country-level geographic blocking, and bot and vulnerability scanner detection. These security layers are independent of the access policy and can be configured at any time. The circuit will immediately begin generating log entries in the monitoring dashboard for every request it receives, whether allowed or blocked, providing full visibility into traffic patterns from the moment the circuit goes live.

TIP

After creating a circuit, test it immediately by opening the assigned domain in a browser. If the backend service is displayed, the circuit is working correctly. If an error is returned, verify that the Agent is online, the backend service is running and reachable from the Agent device at the specified IP and port, and that the correct protocol (HTTP vs HTTPS) was selected.