Start here
What is not Cloudflare or Neon scale
Named services map Cloudflare- and Neon-shaped jobs onto multi-layered Global Server nodes. This page is the substrate catalog: what those nodes do not run, will not fake, and could still ship without claiming Cloudflare or Neon scale.
This is honest production on multi-layered Global Server nodes: application-layer DDoS and WAF, in-process cache, DNS-JSON (not port 53), and image delivery (not transcoding). It is not anycast or a GPU LLM farm.
Not this substrate
7
Needs a global packet fabric, GPU cluster, or storage/compute split Zipper does not run.
Honest refusal
7
The analogue exists so you can map a skill. Zipper will not fake the missing machine.
More Global Server nodes
3
Another node can shrink the gap. It still will not become anycast.
Shippable here
3
Could land in the Zipper process without claiming Cloudflare or Neon scale.
Not this substrate
Needs a global packet fabric, GPU cluster, or storage/compute split Zipper does not run.
| Analogue | Zipper runs | Missing scale |
|---|---|---|
Anycast PoP map cloudflare · network | Unicast Global Server nodes. Visitors who point A at tinyzipper.com land on that address. | Hundreds of anycast interchanges, Anycast BGP, Maglev-style nearest PoP. |
Magic Transit / L3–L4 absorb cloudflare · network · moat | The Moat: per-IP HTTP request cap on Zipper that returns 429. | Packet scrubbing, SYN-flood absorb, BGP advertisement of customer prefixes. |
Workers V8 isolates cloudflare · runtime · functions | Edge Functions: timed node:vm on Zipper, default 30ms CPU, 32 KiB source. | V8 isolate farm, bindings (KV, D1, R2, Durable Objects), 30s+ wall time on paid. |
Workers AI / GPU LLM farm cloudflare · runtime · ai | Edge AI: zip-fast / zip-large / embed-v1 against the Zipper corpus on CPU. | Rented GPUs, general chatbot, model garden. |
Cloudflare Durable Objects / Neon / Supabase Realtime bus Cloudflare + Neon · data · cellar | The Cellar emits SSE on the Zipper process for the requesting hatch. | A global pub/sub, cross-region ordering, millions of concurrent sockets. |
Neon storage/compute split neon · data · cellar | Encrypted overlay rows in shared tables on the control-plane database. | Safekeeper + pageserver, copy-on-write storage pages, scale-to-zero compute. |
Spectrum (arbitrary TCP/UDP) cloudflare · network | HTTP(S) on Zipper, media from object storage, Cellar wire on loopback 15432. | Proxy Minecraft, SSH, or random TCP through an anycast edge. |
Honest refusal
The analogue exists so you can map a skill. Zipper will not fake the missing machine.
| Analogue | Zipper runs | Missing scale |
|---|---|---|
Authoritative DNS on UDP/TCP 53 cloudflare · protocol · herald | The Herald stores records and answers DNS-JSON at GET /dns-query. | Nameservers, registrar NS cutover, DNSSEC, AXFR. |
Polish / Image Resizing / AVIF cloudflare · media · gallery | The Gallery serves original bytes from Zipper object storage; The Crown may cache them. | On-the-fly resize, format convert, EXIF strip. |
Stream encode + adaptive HLS cloudflare · media · video | Video Delivery stores and plays the file you PUT in Zipper object storage. | Transcode ladder, DRM, captions pipeline, global ingest. |
Pages Functions / SSR Node cloudflare · runtime · hosting | Site Hosting builds git repos to static files. Next.js needs output: "export". | Long-running Node origin, server components at the edge, `pages.dev`-scale isolation. |
Email Routing + outbound SMTP cloudflare · ops · email | Emails stores inbound messages and routes mailbox / webhook / function. AES-256-GCM at rest. | Outbound send, DKIM on the wire, a mail transfer agent. |
Stock Postgres :5432 neon · data · cellar | DATABASE_URL talks to Zipper’s sealed-query PGWire adapter (127.0.0.1:15432). | Host Postgres parser, Postgres roles, extensions, superuser. |
Detonation sandbox / full AV engine cloudflare · runtime · guard | Palace Guard: public hashes, EICAR, canary, web-shell names, MIME polyglots, ZIP headers — no inflate. | Emulation sandbox, signature cloud, exploding zip bombs safely at hyperscale. |
More Global Server nodes
Another node can shrink the gap. It still will not become anycast.
| Analogue | Zipper runs | Missing scale |
|---|---|---|
PoP CDN cache cloudflare · ops · crown | The Crown: in-process Map on Zipper, 800 objects, TTL + SWR, gzip/brotli. | Disk/SSD cache in every city, cache that survives process restart, regional purge. |
Geo / latency load balancing cloudflare · network · drawbridge | The Drawbridge health-checks origin pools across Global Server nodes. | Steer by continent, steering via anycast, pool diversity across 300 cities. |
R2 global replication cloudflare · data · archives | The Archives: objects in Zipper object storage, metadata on the control plane, AES-256-GCM, HMAC URLs. | Multi-region copies, public buckets with CF-scale egress, S3-complete API. |
Shippable here
Could land in the Zipper process without claiming Cloudflare or Neon scale.
| Analogue | Zipper runs | Missing scale |
|---|---|---|
Persistent edge cache cloudflare · ops · crown | Crown entries live in the Node process and drop on deploy or crash. | Warm cache across restarts. |
HTTP/3 / QUIC at the edge cloudflare · protocol · vault | nginx terminates HTTP/2 in front of Zipper. | QUIC to the visitor, UDP 443 anycast. |
Full SQL surface (windows, extensions, pgvector…) neon · data · cellar | Restricted Cellar dialect: tables, policies, seals, REST, RPC, snapshots. | Arbitrary SQL, contrib extensions, stored procedures on the host. |
Shape we already match
These jobs exist in production on Zipper. They are still not Cloudflare or Neon scale.
- WAF HTTP rules
The Keep evaluates managed and custom expressions before origin. It is application-layer, which is also what Moat does not pretend about packets.
- Turnstile Siteverify JSON
Portcullis is first-party: widget, proof-of-work, one-time token, POST /api/portcullis/v1/siteverify. Sensitive Zipper actions use it.
- API rate limits
The Scepter caps public APIs on Zipper. Pair with Portcullis on login. This is not Cloudflare API Shield ML.
- Access identity proxy
The Throne Room puts HMAC cookies in front of a private origin. The origin should not also have a public A record.
- cloudflared outbound Tunnel
Origin Connect dials Zipper outbound. No inbound hole. The connector is not an anycast pair.
- Waiting Room
Visitor Queue parks excess sessions on Zipper when a path exceeds its budget. Included, not a separate SKU.
- Queues
Job Queues are durable rows with AES-256-GCM payloads. At-least-once, dead-letter, not a global mesh.
- HTTP analytics
Watchtower is workspace-scoped request / WAF / Moat / Portcullis telemetry. Log push is a plan entitlement, not a SIEM product.
- (none at Cloudflare)
Palace Guard is Zipper’s edge antivirus. Cloudflare has no analogue; the gap is detonation, not existence.
How to use the catalog
A site that needs Magic Transit
You are absorbing volumetric L3 and also want Portcullis + workspace billing.
- Keep packet absorb where it lives. Zipper Moat will not take the NIC.
- Point web hostnames at tinyzipper.com for Keep, Crown, and Portcullis on HTTP.
- Do not change nameservers expecting The Herald to speak port 53.
An app that needs Neon's pageserver
You want copy-on-write storage clones and stock Postgres, plus Zipper's hatch.
- Use Neon or RDS for the engine that must be Postgres.
- Use The Cellar when the point is sealed queries, capability seals, and fail-closed Origin.
- Do not send tenant SQL expecting it to hit host Postgres. It will not.
Next: Getting started · All docs · Create a free account