Give a briq its HTTPS URL, on one port (https://<briq>-<4 random characters>.<domain>, kept for the life of the briq). mode "private" opens only with the URL you get back: it carries a secret, briq turns away every request without it before it reaches the briq, and the browser keeps it as a cookie after the first visit. Use "private" whenever the person wants it private, protected or only for them; "public" is open to anyone on the internet. Visits to the URL count as use for its whole stack, so an exposed briq sleeps only when nobody uses it, and a visit to a sleeping one wakes it. A briq has one URL, on one port: its front door (the one a recipe names, or the only port in `ports`) is published at once; another port moves the URL there and restarts the machine (processes start over, files on disk are kept). Without `mode`, a URL that already exists keeps the mode it has, so moving a private URL never opens it; a first URL is public. `rotate: true` gives a private URL a new token, for when the link went somewhere it should not have: the URL stays, the old token stops working; a public URL has none to rotate. A briq declares at most 32 ports. Simplest: briq_run with `expose`. `protocol` other than "http" makes a TCP endpoint instead, for a client outside briq (psql, a BI tool, a laptop): <briq>-<10 random characters>.tcp.<domain> on the usual port of its protocol, TLS required. postgres (5432), mysql (3306), redis (6379), mongodb (27017), amqp (AMQPS 5671), bolt (Neo4j, 7687), grpc (6334). The database port of a recipe (briq_status lists them as databasePorts) answers with its full connection string, password included; another briq gets the address, to which you add its user and password. No token: the password is the gate, so `mode` does not apply, and the edge refuses a Postgres, Redis or MongoDB that lets anyone in. Only when the person wants to reach the service from outside: briqs of the stack reach it on its internal address already.