Genesis Outposts

​

What an Outpost is

• Outbound only. The Outpost dials Genesis over HTTPS (port 443). You open no inbound port, and your traffic does not pass through infrastructure Genesis runs.
• You set the ceiling. The Outpost reaches only the host:port destinations you list in its own settings (ALLOWED_DESTINATIONS), whatever Genesis asks for.
• Credentials can stay home. A connection can store a reference to a secret instead of the password. The Outpost reads the value from your own secret store at connect time.
• Nothing else changes. A connection routed through an Outpost keeps its real host name, port and TLS settings. Agents, missions and apps use it like any other connection.

​

Do you need one?

​

How it works

 Your network                                        Genesis
┌─────────────────────────────┐                    ┌──────────────────────────────┐
│                             │   HTTPS (443)      │                              │
│  Genesis Outpost  ──────────┼───── outbound ────►│  Outpost tunnel endpoint     │
│     │                       │   one WebSocket,   │  (Databricks App or          │
│     │ only ALLOWED_         │   signed in        │   your own host)             │
│     │ DESTINATIONS          │                    │                              │
│     ▼                       │                    │  Connections, agents, apps   │
│  db.corp.internal:5432      │                    │  use db.corp.internal:5432   │
│  jira.corp.internal:443     │                    │  as if it were local         │
└─────────────────────────────┘                    └──────────────────────────────┘

1. An administrator adds an Outpost under Config -> Outposts and installs it with the guided setup.
2. The Outpost signs in to Genesis with its own identity (for a Databricks App, its own service principal), then inside the tunnel with its own tunnel key, and holds the connection open.
3. When you create a connection and answer How does Genesis reach this system? with Through a Genesis Outpost, Genesis asks that Outpost to carry traffic to the connection’s host and port.
4. The Outpost checks each request against its own ALLOWED_DESTINATIONS and opens a connection to the system from inside your network.

​

The tunnel

• Mutual sign-in. Genesis and the Outpost each prove they hold the Outpost’s tunnel key, by answering a fresh challenge. The key never crosses the network.
• Many connections, one WebSocket. Each connection Genesis makes to a routed system is its own stream inside the WebSocket, with its own flow control, so one large transfer does not hold up the others.
• One direction. Only Genesis opens streams, and only toward routes the Outpost itself declared. The Outpost cannot open a stream toward Genesis, and Genesis cannot ask it to reach anything outside its ALLOWED_DESTINATIONS.
• Only Genesis’s own processes. Inside Genesis, a routed connection is accepted only from Genesis’s own processes, not from code that agents run; see Security.

​

Next steps