Managed Edge
We run the public entry point to your service so it stays up under load and never leaks its origin.
Included
- HAProxy and OpenResty in front of your backend, with the origin unreachable from the internet
- TLS 1.3 and HTTP/3, certificates issued and rotated without your involvement
- WAF in blocking mode, with rules tuned to your traffic rather than left on a vendor default
- Per-route rate limits and a circuit breaker that fails fast when an upstream stops answering
- Structured request logs shipped to storage you control, with the real client IP preserved
- A monthly report: what was blocked, what broke, what changed
How the work runs
We start by reading your current entry point: certificates, ciphers, headers, DNS, and whether the origin can be reached directly. That takes a few days and produces a written list of what is exposed, ordered by how much it would cost you.
Then we build the edge on your infrastructure using our own automation, cut traffic over during a window you pick, and keep the old path available until you are ready to drop it.
After that we operate it: certificates, WAF rules, upgrades, and the response when something starts hitting you at three in the morning.
What we need from you
Access to the servers that will run the edge, control of the domain’s DNS, and one person who can answer questions about how the application behaves. We do not need access to your application code or your database.
Where this does not apply
If you run a single server with no attack traffic and no uptime commitment, this is more machinery than your problem deserves. If you are already on a managed platform that terminates TLS and filters traffic for you, the honest answer is that you are paying us to duplicate it.
What this draws on
These areas of the catalogue are covered by the package, or alongside it.