DNS · TLS · Cache · Firewall · Load balancing · Functions
An edge platform that tells you why.
Every CDN can block a request. The thing that costs you an afternoon is that none of them will tell you which rule did it, what that rule saw, or what your cache key actually was.
Already use guardyn.dev? The same email and password works here.
This is the whole pitch
One request, and everything the edge decided about it — including the decisions that did not fire, which is the half every other product throws away.
403 GET example.com /wp-admin RU cache=BYPASS 2.4ms rule=custom/4
ip access no lists configured skipped
managed guardyn_owasp_core 38 signatures, 0 matched 0.31ms
custom 1 office allowlist no match
ip.src = 198.51.100.7
4 block scrapers MATCHED
ip.geoip.country = "RU"
$blocked_countries contains "ru" → block 403
rate limit did not run — a blocked request consumes no budget
bots did not run
cache BYPASS key host:11:example.com|path:9:/wp-admin
reason: the request never reached the cache phase
origin not contacted
timings accept 41µs · tls 780µs · firewall 1.2ms · respond 8µs“did not run” rather than a missing line. A phase that was skipped and a phase that found nothing are different facts.
Three things that are not normal
Configuration is a signed snapshot
Every apply writes one immutable, content-addressed, Ed25519-signed blob. The data plane holds exactly one and swaps it atomically. There is no partial apply, no half-propagated state, and no request served by a mixture of two configurations.
gdn plan · gdn apply · gdn rollback
A simulator that cannot lie
Send a synthetic request through the real pipeline against any snapshot — live, draft, or last Tuesday's — and get the full trace back. It is the same code path, not a model of it, so it cannot disagree with production.
no origin traffic, no side effects
Missing is not unknown
A rule on ip.geoip.country distinguishes “this request came from nowhere we can identify” from “we have no GeoIP database loaded”. The second is a configuration problem and silently treating it as the first is how a country block quietly stops working.
FieldValue::Missing vs Unknown
Everything in front of your origin
One control plane, one configuration, one trace. Not five products with five dashboards that each know a third of the story.
Authoritative DNS
A, AAAA, CNAME, ALIAS at the apex, MX, TXT, SRV, CAA, NS, PTR. Proxied records answer with our address; DNS-only records answer with yours and we never see the traffic.
Read more →TLS, issued and renewed
Certificates by ACME, free on every plan. SNI resolution per hostname, TLS 1.2 minimum by default, and HSTS with a preload gate that makes you enable it twice.
Read more →A cache you can interrogate
Two tiers, memory over disk, weighed by bytes. Single-flight collapse so a thundering herd is one origin fetch. Purge by URL or tag, evaluated lazily as tombstones.
Read more →A firewall with a language
Wireshark-style expressions over 31 fields. Compiled when the configuration is built, so a bad regex is a config error you see at authoring time, not a 500 at 3am.
Read more →Load balancing in two layers
A pool balances between interchangeable servers; a load balancer steers between pools. Conflating the two is why “why did my EU traffic go to us-east” is hard to answer elsewhere.
Read more →Traces and analytics
Per-request traces with a ray id you can quote in a support thread, and rolled-up analytics at one-minute, one-hour and one-day granularity.
Read more →What is not finished
Listed here rather than discovered later. A roadmap presented as a feature list is the thing this product exists to be the opposite of.
- todoRate limiting. The rule type, the phase and the trace line exist. The counter does not, so a rate-limit rule reports “did not run” rather than silently passing.
- todoBot scoring. Verified-bot allowlisting works. Scoring does not.
- todoWASM functions. The plan limits, deployment records and CPU accounting are in place. The runtime is not.
- todoHTTP/3. Advertised per zone and off by default, because QUIC is not served yet.
- todoResponse streaming. Bodies are buffered to 64 MB rather than streamed, so this is not yet the right thing to put in front of large downloads.
Try it without pointing a domain at anything
One command brings up a zone, an origin, a firewall rule and an edge node on your own machine, and verifies six things end to end. Nothing is published.
git clone https://github.com/ahmedawachi/web.guardyn.dev cd web.guardyn.dev && ./examples/amthalgroup/demo.sh up