Architecture

The three-tier self-hosted model — cluster manager, worker fleet and cloud control plane.

VeilBrowser separates duties across three tiers. Each has one job, which keeps the system auditable and safe to operate.

The three tiers

Cluster manager

Runs on the load-balancer box. Owns the LB config, serves the release origin, and orchestrates the fleet. All changes go through audited operations.

Workers (Local API)

Each fleet host runs the Local API. Workers are the only tier that launches browsers.

Cloud control plane

The source of truth for accounts, plans, billing, licensing and analytics.

Separation of duties

Only workers launch browsers.
Only the cluster manager orchestrates the fleet and reloads the load balancer.
Only the cloud control plane owns identity, plans, billing and licensing.

The config-reload pipeline

The cluster manager owns the load balancer's configuration. It is never edited by hand — every change is staged, validated, atomically swapped, and reloaded as an audited operation.

This means a bad configuration can never take down a running load balancer: if validation fails, the live config is left untouched.

Before launching a browser, a worker calls POST /v1/license/authorize on the cloud control plane. The cloud is authoritative on organization-wide concurrency and plan limits; the worker fails closed if authorize is denied or unreachable. Session start/end is tracked via the profile session endpoints. See Licensing & concurrency.