DNS · TLS · Cache · Firewall · Load balancing · Functions

An edge platform that tells you why.

Every CDN can block a request. The thing that costs you an afternoon is that none of them will tell you which rule did it, what that rule saw, or what your cache key actually was.

Already use guardyn.dev? The same email and password works here.

This is the whole pitch

One request, and everything the edge decided about it — including the decisions that did not fire, which is the half every other product throws away.

one trace403
403 GET example.com /wp-admin RU cache=BYPASS 2.4ms rule=custom/4

  ip access   no lists configured                              skipped
  managed     guardyn_owasp_core   38 signatures, 0 matched     0.31ms
  custom      1  office allowlist       no match
                 ip.src            = 198.51.100.7
              4  block scrapers         MATCHED
                 ip.geoip.country  = "RU"
                 $blocked_countries contains "ru"      → block 403
  rate limit  did not run — a blocked request consumes no budget
  bots        did not run
  cache       BYPASS  key host:11:example.com|path:9:/wp-admin
                      reason: the request never reached the cache phase
  origin      not contacted

  timings     accept 41µs · tls 780µs · firewall 1.2ms · respond 8µs

“did not run” rather than a missing line. A phase that was skipped and a phase that found nothing are different facts.

Three things that are not normal

01

Configuration is a signed snapshot

Every apply writes one immutable, content-addressed, Ed25519-signed blob. The data plane holds exactly one and swaps it atomically. There is no partial apply, no half-propagated state, and no request served by a mixture of two configurations.

gdn plan · gdn apply · gdn rollback

02

A simulator that cannot lie

Send a synthetic request through the real pipeline against any snapshot — live, draft, or last Tuesday's — and get the full trace back. It is the same code path, not a model of it, so it cannot disagree with production.

no origin traffic, no side effects

03

Missing is not unknown

A rule on ip.geoip.country distinguishes “this request came from nowhere we can identify” from “we have no GeoIP database loaded”. The second is a configuration problem and silently treating it as the first is how a country block quietly stops working.

FieldValue::Missing vs Unknown

Everything in front of your origin

One control plane, one configuration, one trace. Not five products with five dashboards that each know a third of the story.

Authoritative DNS

A, AAAA, CNAME, ALIAS at the apex, MX, TXT, SRV, CAA, NS, PTR. Proxied records answer with our address; DNS-only records answer with yours and we never see the traffic.

Read more →

TLS, issued and renewed

Certificates by ACME, free on every plan. SNI resolution per hostname, TLS 1.2 minimum by default, and HSTS with a preload gate that makes you enable it twice.

Read more →

A cache you can interrogate

Two tiers, memory over disk, weighed by bytes. Single-flight collapse so a thundering herd is one origin fetch. Purge by URL or tag, evaluated lazily as tombstones.

Read more →

A firewall with a language

Wireshark-style expressions over 31 fields. Compiled when the configuration is built, so a bad regex is a config error you see at authoring time, not a 500 at 3am.

Read more →

Load balancing in two layers

A pool balances between interchangeable servers; a load balancer steers between pools. Conflating the two is why “why did my EU traffic go to us-east” is hard to answer elsewhere.

Read more →

Traces and analytics

Per-request traces with a ray id you can quote in a support thread, and rolled-up analytics at one-minute, one-hour and one-day granularity.

Read more →

What is not finished

Listed here rather than discovered later. A roadmap presented as a feature list is the thing this product exists to be the opposite of.

  • todoRate limiting. The rule type, the phase and the trace line exist. The counter does not, so a rate-limit rule reports “did not run” rather than silently passing.
  • todoBot scoring. Verified-bot allowlisting works. Scoring does not.
  • todoWASM functions. The plan limits, deployment records and CPU accounting are in place. The runtime is not.
  • todoHTTP/3. Advertised per zone and off by default, because QUIC is not served yet.
  • todoResponse streaming. Bodies are buffered to 64 MB rather than streamed, so this is not yet the right thing to put in front of large downloads.

Try it without pointing a domain at anything

One command brings up a zone, an origin, a firewall rule and an edge node on your own machine, and verifies six things end to end. Nothing is published.

git clone https://github.com/ahmedawachi/web.guardyn.dev
cd web.guardyn.dev && ./examples/amthalgroup/demo.sh up