Applications and services
Responsibilities, ports, health endpoints, and scaling guidance for every Keenpix runtime.
| Runtime | Default port | Responsibility | Scale when |
|---|---|---|---|
apps/app | 3000 | Dashboard, authentication, projects, API keys, SDK management API, billing in cloud mode | HTTP/API traffic or control-plane latency grows |
apps/transform | 3002 | GET/HEAD /img/*, origin safety, Sharp/SVG work, cache and transform analytics | CPU, memory, or transform latency grows |
apps/worker | 3001 | BullMQ prewarm jobs, retries, concurrency, and Workbench | Queue depth or job age grows |
apps/docs | 3003 | TanStack Start + Fumadocs documentation and search | Documentation traffic grows |
apps/custom-domain-edge | Cloudflare Workers | Customer hostname routing and edge analytics | Cloudflare handles scaling |
Health endpoints
| Runtime | Liveness | Readiness |
|---|---|---|
| App | /api/health | /api/health |
| Transform | /health/live | /health/ready |
| Worker | /health/live | /health/ready |
| Docs | /health | /health |
Liveness answers “is the process running?” Readiness also probes required dependencies and should control load-balancer admission.
Transform and worker probes are private, service-local endpoints. The public app
and delivery hostnames do not proxy /health/*; a 404 there is expected.
Transform request ownership
Hosted delivery and the custom-domain edge target apps/transform directly. In self-host mode, apps/app can proxy transform requests to preserve the traditional single public hostname while the data plane remains independently scalable.
Worker and Workbench
The worker consumes the versioned prewarm contract from packages/bullmq and calls the transform service with KEENPIX_WORKER_SECRET. Workbench is served by the worker and protected with basic auth. Set both KEENPIX_WORKBENCH_USERNAME and KEENPIX_WORKBENCH_PASSWORD, or neither. Coolify generates both automatically when they are not supplied.