Configuration is data, not deploys
Rules, routes, limits and certificates live in the control plane. A change recompiles the affected tenant and rolls out to the fleet; nodes hot-apply it without dropping a connection.
Eleven layers. One request path.
Everything in front of your origin, in one place.
netdistance is an edge platform: authoritative DNS, connection admission and DDoS controls, TLS, routing, bot management, a WAF, a CDN cache, and API and AI gateways. They are not separate products bolted together — they are one chain, compiled from your configuration and applied on every node without a restart.
What it is
One configuration, compiled and signed, enforced at the edge
You describe a hostname: where its origin is, which layers are on, what the limits are. That description is compiled into a snapshot, signed, and broadcast to every node, which verifies it and applies it live. Nothing on the request path asks a central service a question — which is why a policy change is fast and why a control-plane outage does not stop traffic being served.
Your plan is enforced, not invoiced later
The layers your package includes are compiled into the snapshot. A plan that does not include the AI gateway does not run it — there is no per-request billing lookup on the hot path, and no cost for a feature you do not have.
Every layer is observable
Each hop writes a structured event: what it decided and how long it took. The portal shows per-layer latency, WAF and bot decisions, cache hit rates and API-key usage — for a single request, or across all of them.
Streaming-first
One parse per request, zero-copy, shared across the chain. Server-sent events, chunked responses and WebSockets pass through rather than being buffered.
A CLI and an API, not just a console
Everything the portal does is a Control API call. The edge CLI drives it from a terminal or a pipeline, scoped by a management key you mint and can revoke.
Manage it from an AI assistant
An MCP server exposes your edge as tools: read your sites, logs and certificates, add a route, purge a cache. Write tools can be disabled outright, and a destructive tool has to be given the exact name of what it will delete.
The request path
What happens between a client and your origin
Each layer runs in-process on the node, in this order. Which of them a hostname runs depends on what it serves — a website skips the API gateway, an API skips the cache — and on the package you are on.
Authoritative DNS
Your zone is served from our own nameservers over UDP and TCP, signed live with DNSSEC (ECDSA P-256, online RRSIG signing, signed NSEC denial). Negative answers carry the SOA, so caches behave. Records: A, AAAA, CNAME, TXT, MX, CAA, NS.
Connection admission
Enforced at TCP accept, before the TLS handshake — the cheapest place to drop an attack. Per-IP and per-subnet new-connection token buckets, concurrent-connection caps, optional per-ASN caps, static and fleet-wide dynamic bans, JA3 denylist, GeoIP country and city, and a Tor-exit feed. Slow handshakes are killed on a timeout.
TLS termination
TLS 1.3 and 1.2 (1.0/1.1 refused), certificates issued and renewed automatically, or bring your own. Per-hostname policy chosen from the ClientHello, so minimum version, cipher-suite allow-list and mTLS are per site. Session tickets are shared across the fleet, so a resumption works on a different node. HTTP/3 (QUIC) and h2 are both offered.
Routing
Hostname to tenant, then longest path-prefix to route. Per-tenant token-bucket rate limits, per-route limits and method restrictions, redirects, path rewrites and header transforms. Weighted multi-origin splits give you canary and blue/green, with sticky steering by IP or cookie; origins are health-probed and failed over.
Bot management
One score per request from several signals: user-agent class, header anomalies, TLS fingerprint, and per-IP behaviour. Declared crawlers are trusted only from their published address ranges. Browsers can be given a JavaScript challenge. Modes are block, log or off — and the score is also handed to the WAF as corroboration.
WAF
OWASP-CRS-style anomaly scoring rather than single-rule blocking, over the decoded URL and query, the request body and selected headers. Four paranoia tiers, custom block/allow/score rules, path exclusions, and a detect-only mode to tune before you enforce.
Cache
Tiered RAM → NVMe → peer, with request coalescing so a thundering herd becomes one origin fetch. Cache keys are signed and purges are scoped. The cache refuses to store authenticated or cookie-bearing responses unless you say they are public.
API shield
Positive security for APIs. Always-on hygiene (known method, body-size cap, JSON well-formedness on writes); with an OpenAPI contract, an endpoint allow-list and JSON body schema validation — anything off-contract is rejected as a shadow API. Monitor mode logs instead of blocking.
API gateway
Who, how much, what scope. API keys, JWT, JWKS/OIDC and OAuth2 client credentials; per-route scopes; per-key rate limits, monthly quotas and expiry, with limits shared across nodes. CORS and CSRF, GraphQL depth and introspection guards, webhook HMAC with replay protection, and API versioning with deprecation and sunset headers.
AI gateway
For traffic to model providers: prompt-injection detection, and a PII/secret guard that blocks or redacts emails, card and national numbers, cloud keys, private keys and tokens before they leave. Per-tenant rate limits, token metering with monthly budget caps, a prompt cache and multi-provider routing.
Origin connector
Egress to your servers: HTTP/1.1, HTTP/2 or HTTP/3 per upstream on pooled connections, mTLS to the origin, health-aware load balancing with failover, and an origin-shielding tier so only the edge ever talks to you.
Getting started
Three steps to a hostname behind the edge
No agent to install and nothing to run on your servers.
Delegate the domain
Add your domain in the portal and point your registrar at ns1.netdistance.net and ns2.netdistance.net. Verification confirms the delegation before the zone goes live.
Point a record at us
Create the A, AAAA or CNAME record for the hostname you want protected, then run the add-site wizard against it and give us your origin.
Get a certificate and go
A certificate is issued and renewed for you, or upload your own. Traffic starts flowing through the chain the moment the configuration reaches the fleet.
Operating it
The portal, the CLI, and the status page
Client portal
Sites, DNS, certificates and TLS policy, WAF and bot settings, cache and purges, API keys and schemas, per-layer analytics and request logs — with a trace view that shows every hop one request took.
Status
A synthetic prober walks the real user journeys — DNS, the edge itself, TLS, sign-in, the portal — every two minutes, and the results are published as uptime, response times and incident windows.