تیزرس — what this site is standing behind

The site you are reading right now is served through تیزرس, and this page is drawn from the CDN's own repository documentation — not paraphrased from memory, read directly out of README.md, docs/config-plane.md, docs/admin-api.md, docs/monitoring.md and docs/running.md in the cdn checkout on the same box that built this demo.

One nginx.conf that never changes per domain: certificates, origins, path rules, WAF mode and rate limits all come from a JSON config plane loaded into shared memory, and a request path that never parses JSON and never touches disk.

The headline number

Domain count does not affect request latency. Measured on one edge with 10,000 domains: a cache HIT costs 0.20 ms p50 and 0.072 ms of CPU — the same as with three domains. The WAF is the one thing that costs real capacity, which is exactly why it is a per-zone setting (access.waf: off / detect / block), not a fleet-wide switch.

What a zone actually is

A zone is a site: every hostname it owns — apex, www, wildcards — shares one config and one certificate. This demo is one such zone, added alongside the platform's other three (www.zag.taxi-plus.ir, cloud.zag.taxi-plus.ir, id.zag.taxi-plus.ir) without touching any of them — the config plane is designed for exactly that: a zone that fails to compile is set aside on its own, the rest of the fleet keeps serving, and a tenant's typo never takes anyone else down. See the config plane for the full shape.

Where a connection is reused, and where it deliberately is not

Connections to an origin are kept open when that is safe — worth about 19× the throughput on a cache MISS, measured at 31.6k req/s against 1.7k, and 1.5 ms against 28 ms of latency. But nginx's upstream keepalive pool is keyed by peer address, never by the name spoken over it, so at load time the edge counts how many distinct hostnames ever address each origin. Exactly one, and connections pool; more than one, and they do not — because two zones trading pooled connections under different names is a real cross-tenant SNI leak this project has already had once, and fixed structurally rather than by convention.

The network mode, measured

The edge container uses the host's network stack, not Docker's bridge. Same image, same config, only the network mode differing:

Which is also why the four edges in this fleet bind ports 80, 443/tcp and 443/udp directly, and the admin port (127.0.0.1:8081) is reachable only from inside each box — never mapped out, checked independently from both sides in docs/13-cdn-edges.md.

What this demo adds, concretely

One more zone, cdn-demo, hostname demo.zag.taxi-plus.ir, origin a Kubernetes Service on zagros's own internal MetalLB pool. Caching on for everything under this site; explicitly off for /api/now and /api/edges via a path rule, the same mechanism documented below already uses for /api/export-shaped endpoints elsewhere. A real Let's Encrypt certificate, HTTP/3 advertised, WAF in detect — identical posture to the platform's other three zones.

Working on تیزرس itself

Not part of this demo, but worth knowing it exists:

./tests/lint.sh && ./tests/run-unit.sh && ./deploy/selftest.sh   # seconds
./tests/run.sh                                                   # minutes; twice before a commit

Every fix in that repository carries a test that fails without it; every number quoted on this page was measured on a running system, and the docs say so.