Inline Networking
The Realtime Engine is highly adaptable, capable of operating seamlessly within a wide range of networking configurations. Depending on the specific network topology, multiple integration options are available to ensure optimal performance and compatibility between Spec and your protected origin.
important
These network configurations apply exclusively to Inline processing modes (refer to Processing Modes). In Mirror processing mode, Spec does not handle traffic forwarding to the origin, and these downstream routing configurations are not utilized.
Default Inline Integration
The default inline integration with Spec is where DNS resolves to a CDN. The request then is sent through a worker code bundle, which forwards Spec for realtime analysis before resolving to origin servers. Our realtime engine requires a downstream SSL certificate that is valid for the incoming hostname (unless Destination Routing is enabled) on the downstream origin. For more information on the service worker integration, check out Service Workers for more information on how to use this integration.
Advanced Routing
The following routing configurations extend the default inline integration behavior and are designed to offer greater flexibility in handling hostnames and SSL with the realtime engine.
Distributed Networking
Spec’s distributed networking capabilities allow traffic to be intelligently routed to multiple origin servers using one or more hostnames. This enables Spec to operate as a load balancer, efficiently managing traffic across various IP addresses or hostnames in both 1:1 and 1:N deployment models.
note
In this configuration, Spec distributes traffic evenly across all downstream hosts. Traffic allocation is randomized to ensure a balanced distribution under typical load conditions without affecting processing overhead. This feature is compatible with both Destination Routing and Worker Sidechain configurations.
Destination Routing
Our realtime engine requires a downstream SSL certificate that is valid for the incoming hostname, unless destination routing is configured. In this configuration, additional SSL certs and hostnames may exist upstream from Spec, and the realtime engine will use a defined hostname as the SSL hostname, while using the incoming host value for the HTTP Hostname.
This is useful to manage many hostnames and certificates at the CDN layer instead of the origin servers, which may not contain the same certificates. In order for destination routing to work, you must have at least one hostname certificate installed on your origin server.
note
In this configuration, the existing HTTP hostname-based routing between the CDN and the origin is preserved. It also enables Spec to create secure encrypted connections between the Realtime Engine and protected origin servers, ensuring end-to-end security while maintaining compatibility with upstream TLS expectations.
Worker Sidechain
The worker sidechain configuration creates the lowest barrier integration, which also provides the most flexibility, at the expense of overall latency. The logic in the service worker must be updated to first check for the existence of a signed header from Spec servers, if a signed header is found the request bypasses Spec and heads directly to origin servers. Otherwise, the request is sent to Spec for signature using enterprise encryption protocols.
This allows Spec to exist outside of the direct network path, but it does introduce 1 additional network hop. Instead of going directly to an origin server, Spec must go through the CDN and worker layer a second time. This method can be implemented in staging environments where hostnames, SSL certificates, and other configurations are in constant subject to change.
note
Due to the secondary invocation of the service worker, this network path introduces two additional hops compared to alternative implementations. As a result, traffic volume through both the CDN and Worker layers is effectively doubled. The primary advantage of this integration is that all downstream and upstream network modifications from the worker can be performed independently of Spec's configuration.