# Multi-region ingress

Blekline separates **control plane** (tenant policy + audit) from **ingress edge** (low-latency mask/enforce near agents).

## Target regions (Daytona-aligned)

| Region code | Location | Edge URL (example) |
|-------------|----------|-------------------|
| `us-west-2` | US West (Oregon) | `https://ingress-us-west.blekline.com` |
| `us-east-1` | US East (Washington DC) | `https://ingress-us-east.blekline.com` |
| `eu-west-2` | EU West (London) | `https://ingress-eu-west.blekline.com` |
| `eu-central-1` | EU Central (Frankfurt) | `https://ingress-eu-central.blekline.com` |
| `ap-south-1` | Asia-South (Mumbai) | `https://ingress-ap-south.blekline.com` |

## Architecture

```
Agent (Cursor/Codex) in Mumbai
  → ingress-ap-south sidecar (local enforce <10ms)
  → policy cache (SSE from control plane)
  → async audit events → app.blekline.com (or EU tenant)
  → approved tool calls → Daytona MCP (same region)
```

## Deploy edge sidecar

```bash
pnpm build:packages
docker build -t blekline-ingress -f packages/ingress-proxy/Dockerfile .

docker run -d -p 8787:8787 \
  -e BLEKLINE_INGRESS_REGION=ap-south-1 \
  -e BLEKLINE_INGRESS_TARGET=https://app.blekline.com \
  -e BLEKLINE_WORKSPACE_TOKEN=blw_... \
  -e BLEKLINE_WORKSPACE_ID=ws_... \
  -e BLEKLINE_EDGE_LOCAL_MASK=true \
  blekline-ingress
```

Helm: `packages/ingress-proxy/helm/blekline-ingress/`

### Sidecar endpoints

| Route | Purpose |
|-------|---------|
| `GET /health` | Region + local mask latency p50/p95 |
| `POST /v1/enforce-tool-call` | **Edge-local** tool policy (<10ms p99 target) |
| `POST /v1/chat/completions` | OpenAI-compatible with edge pre-mask |
| `POST /v1/messages` | Anthropic-compatible with edge pre-mask |

## Control plane env (webapp)

```bash
BLEKLINE_MASK_FAST_PATH=local_first   # skip Azure when local pass is clean
BLEKLINE_INGRESS_REGION=eu-central-1  # reported in x-blekline-ingress-region
```

## Latency SLOs

See [Latency SLO](/docs/reference/latency-slo).

## Stack with Daytona

Same region for both layers:

| Layer | Product | Typical latency |
|-------|---------|-----------------|
| Ingress | Blekline edge | p99 tool enforce **<10ms** |
| Ingress | Blekline fast mask | p95 **<20ms** |
| Runtime | Daytona sandbox | **<80ms** create (Daytona SLO) |

**Do not compare Blekline Azure mask to Daytona sandbox boot** — different layers.

---

**Next steps:** [AI Enablement Stack](/docs/introduction/ai-enablement-stack) · [Ingress proxy](/docs/api/ingress-proxy) · [Daytona stack](/docs/integrations/daytona-stack) · [Open workspace](https://app.blekline.com) · [Report issue](https://github.com/Blekline/blekline-oss/issues/new?template=bug_report.yml)