Glossary¶
Every term these guides use, in one place. Chapters restate the parameters they depend on, so you should not need this page to follow one, but a term you meet halfway through is defined here.
Edgible¶
| Term | What it means here |
|---|---|
| Serving agent | The daemon installed on the machine that runs your service. It holds an outbound connection on TCP 443 and proxies traffic to a local port. |
| Serving device | The registered record of that machine in the console, with a name such as minipc and a health state. Not interchangeable with serving agent. |
| App | One published hostname pointing at one local port, with one auth mode. A single process can be published as several apps. A TCP or UDP app has no auth mode. |
| Published hostname | The public HTTPS address an app answers on. Standard shape: https://<app>.<org>.edgible.com, where <app> is the app name you chose at publish time and <org> is your organisation label in Edgible. In examples, angle brackets mark placeholders; always copy the exact host from edgible app list or the console. |
<app> |
The app name in a published hostname, such as hello-world in hello-world.<org>.edgible.com. |
<org> |
Your organisation label in a published hostname, such as acme in hello-world.acme.edgible.com. Not the word "org" literally; copy the label from edgible app list. |
| Custom domain | A name of your own added to an app, pointed at its Edgible hostname with a CNAME. Edgible then issues a certificate for it too. It must be in a domain you own: every name under edgible.com is reserved for the hostnames Edgible generates, so Edgible refuses one such as www.edgible.com as a custom domain. |
| Zero-DNS publish | First publish returns a working https:// hostname with certificate and routing, with no registrar step and no DNS record to create. Same idea as a generated or platform-provided hostname. |
| Split-surface publish | Two or more hostnames on the same local process, each with its own auth mode — for example org on an admin UI and None on a webhook path. Familiar as a separate admin hostname or dual exposure of one backend; not VPN split tunneling. |
| Auth mode | The access rule attached to a hostname, chosen when the app is created: org, api-key or None. |
org |
Auth mode requiring a browser login from your organisation. Used for anything holding credentials, such as the n8n editor or the OpenClaw Control UI. |
api-key |
Auth mode accepting a bearer secret, for callers that cannot complete a browser login. Used for the published Ollama. |
None |
Auth mode with no check, for callers such as Stripe or GitHub webhooks that cannot sign in. |
| Org | Your organisation in Edgible. It appears in every hostname and defines who org auth lets in. |
| Unpublish | Removing an app, which takes its hostname down while leaving the service running and other apps serving. |
| TCP app, UDP app | An app created with --protocol tcp or --protocol udp, which carries the connection or the packets unchanged to a local port. It answers at <app>.<org>.edgible.com:<port> and has no auth mode, because there is no browser request to sign in with. |
| Public port range | The ports a TCP or UDP app can use on the managed gateway: 20000 to 29999. The public port is the --port you publish, and one app holds a port on its gateway at a time. |
Networking¶
| Term | What it means here |
|---|---|
| Outbound only | The serving agent opens the connection and keeps it open, so nothing listens for inbound connections and no router change is needed. The direction matters: a connection your machine starts needs no forwarded port, because the reply comes back down a connection the router already knows about. |
| Port forward | A router rule exposing a local port to the internet. These guides never use one, and the checklist of every chapter that publishes a port confirms it is still not forwarded. |
| Virt LAN | The private network between a host and its own virtual machines, often 192.168.64.x under UTM. It reaches the host, and nothing outside that machine. |
| E.164 | The international phone number format, such as +61412345678, used when allow-listing who may message an agent. |
| Loopback | The 127.0.0.1 address, reachable only from the machine itself. Services in these guides bind here, and the serving agent reaches them locally. |
| NAT | The address translation a home router does. It is sufficient for Edgible, because the connection is outbound. |
| Mesh VPN | A private network requiring every client device to be enrolled. One of the alternatives Edgible replaces. |
| Reverse proxy | A server such as nginx or Caddy placed in front of a service, usually paired with certbot and dynamic DNS. Another alternative Edgible replaces. |
| Tunnel | A mechanism word from the wider market, meaning traffic carried inside another connection. It is worth knowing because it covers three jobs that are not the same: publishing a service so anyone can reach it, joining your own devices on a private network, and getting out through a network that restricts you. These guides describe what you actually configure instead, so the serving agent holds an outbound connection and an app is published. Where the word appears here it means an SSH tunnel, below. |
| SSH tunnel | A port carried over an SSH session you open yourself, as in ssh -L 3000:127.0.0.1:3000. It lets a browser on your laptop reach a service bound to the guest's loopback before that service is published, as in Umami on the VM. It is temporary, involves no Edgible app, and closes when the session does. |
| TLS termination | Where HTTPS is decrypted. With Edgible it happens on the serving device, which is why the original client IP does not reach the app. |
| Webhook | An HTTPS URL another system calls. It needs a hostname reachable without a login, so None rather than org. |
Website, analytics and monitoring¶
| Term | What it means here |
|---|---|
| Static site | A directory of files a web server hands over unchanged, whatever produced them. Nothing runs per request. |
| Umami | Self-hosted web analytics: page views without cookies, with the database on your own machine. |
| Tracking script | The script.js Umami serves and your pages load. It must come from a hostname with None, because visitors have no login. |
| Website ID | The UUID Umami assigns your site, named in the tracking snippet so hits are attributed to it. |
| Ingest hostname | The None hostname visitors' browsers reach, as opposed to the org hostname you read the numbers on. Both point at the same process. |
| Uptime Kuma | Self-hosted uptime monitoring: it requests a URL on a schedule and notifies you when the answer changes. |
8080 |
The site's nginx port on the guest, bound to loopback. |
3000 |
Umami's port on the guest, bound to loopback. |
3001 |
Uptime Kuma's port on the guest, bound to loopback. |
| Card | A YAML file of a pattern: the apps (name, image, port, auth mode) and a place for which apps share a serving device. The Compose file sits in the same directory. The copy you share has no device name, no hostname, no organization id, and no passwords. The cards live in edgible-org/cards, and the format and tools in edgible-org/card-kit. The source of truth is card.schema.json. The website card is website/card.yml, used in The website card. The n8n card is n8n/card.yml, used in The n8n card. The assistant card is assistant/card.yml, used in The assistant card. |
| Place | A name on a card for applications that share a serving device. It is not one of your device names. You map each place to a serving device when you publish. |
n8n¶
| Term | What it means here |
|---|---|
| n8n | The workflow runner: the canvas and the executions. Not OpenClaw. |
| Editor | The n8n canvas in a browser. Published with org because it holds every credential you have added. |
n8n-hooks |
The second app on the same container, with None, so outside callers can reach webhook URLs. |
WEBHOOK_URL |
The n8n setting naming the origin it prints on webhook nodes. It changes what n8n advertises, not where traffic lands. |
5678 |
n8n's HTTP port on the guest, bound to loopback. |
OpenClaw¶
| Term | What it means here |
|---|---|
| Gateway | The OpenClaw process on the VM. It stays on loopback; Edgible publishes it rather than it listening publicly. |
| Control UI | The OpenClaw web interface, published with org so it opens on a phone without a VPN. |
| Skill | A capability added to OpenClaw. The Edgible skill lets it run the Edgible CLI. |
| ACP | Agent Client Protocol, the exchange two programs hold over stdin and stdout: start a session, send a prompt, stream tool calls, finish. OpenClaw is the client. |
acpx |
The OpenClaw plugin that owns the ACP client. Until it is installed and the Gateway restarted, /acp doctor reports ACP_BACKEND_MISSING. |
| Harness | Cursor CLI running as the ACP server, via agent acp. |
| Session | One ACP job, keyed as agent:cursor:acp:<uuid>. |
18789 |
The OpenClaw Gateway port on the VM, bound to loopback. |
permissionMode |
How much OpenClaw does without asking. approve-reads asks before writing; approve-all stops asking, which is what an unattended coding pass needs and what you set back afterwards. |
| BotFather | Telegram's own bot for creating bots. It issues the token the Telegram client uses. |
| Linked device | A WhatsApp session paired by scanning a QR code, the same mechanism as WhatsApp Web. |
| SearXNG | A self-hosted search backend. n8n's AI Assistant uses it rather than a hosted search API. |
Self-hosted models¶
| Term | What it means here |
|---|---|
| Ollama | The local model runner these guides publish with api-key. |
| Ollama.app | The macOS menu-bar app. The error could not find ollama app means you are on Linux, or the app is quit. |
| Bare metal | macOS on the Mac itself, not the Ubuntu guest inside it. Ollama runs here for GPU access. |
| Metal | How Ollama reaches the Mac GPU. A UTM guest cannot, which is why inference stays on the host. |
| Model tag | The name and size of a model, such as qwen2.5:7b or gpt-oss:20b. |
11434 |
Ollama's HTTP port, on the Mac by default. |
Game server¶
| Term | What it means here |
|---|---|
| Java Edition | Minecraft on Windows, Mac and Linux PCs. It connects over TCP, by default on port 25565. |
| Bedrock Edition | Minecraft on phones, tablets, Windows and consoles. It connects over UDP, by default on port 19132. |
| Paper | A Minecraft Java server that loads plugins. Game server on Edgible runs it in the itzg/minecraft-server image. |
| Geyser | A plugin that lets Bedrock players into a Java server by translating between the two, so both editions share one world. |
| Floodgate | Geyser's companion plugin, which lets Bedrock players in without a Java account. Geyser uses it when its auth-type is floodgate. |
| Online mode | A Java server setting that checks every player's account. On by default; these guides leave it on. |
| Whitelist | The list of players allowed in. With a TCP or UDP app, which has no auth mode, it is what decides who plays. |
mc-monitor |
A status checker shipped in the itzg images. status pings a Java server over TCP, and status-bedrock pings a Bedrock server over UDP. |
The machines in these guides¶
| Term | What it means here |
|---|---|
| Ubuntu guest | The virtual machine running the serving agent, created in Edgible on an Ubuntu VM. Most commands run here. |
| Host computer | The laptop or desktop the virtual machine runs on. In LLM on Edgible it is a Mac, and it runs Ollama. |
| Hello World | The first published page, used throughout as the check that publishing still works. |
8081 |
The Hello World nginx port on the guest, bound to loopback. Later chapters check it is still what hello-world points at. |
Last updated