The Stage

What it is

The Stage connects a git repo. Zipper builds it — static files or an SSR Node origin — puts the production branch up on your domain, gives every other branch its own stage with a preview URL, and lets you roll back to an earlier deploy. Secrets sit encrypted. Pair Edge Functions for rewrites and cron. Attach your own domain when you are ready.

Cloudflare analogue: Cloudflare Pages / Vercel. SLA 99.95% · p99 40ms. Admins connect the repository. Viewers may inspect preview URLs.

• ▸Git deploys
• ▸SSR Node origins
• ▸A stage per branch
• ▸Instant rollback

How it works

Connect a public or private GitHub or GitLab HTTPS repo (optional deploy token for private). The www site for workspace acme is https://acme.sites.tinyzipper.com (Zipper’s pages.dev / vercel.app). Zipper shows a webhook URL once — paste it under repo Settings → Webhooks, and paste the last path segment as the secret. Push queues a build on Zipper. Static export works (`output: "export"` → `out/`). For SSR use Next `output: "standalone"`, or Astro / SvelteKit / Nuxt / Remix Node adapters — `zipper-runtime` runs a mesh-gated Docker Node origin per live deploy. Pair Edge Functions for rewrites and cron.

Each deploy is immutable. Append ?d={sha} for a unique URL. Promote a previous sha to roll production back instantly (SSR origins start/drain with the pointer flip).

Environment variables layer like Vercel: production, then preview overrides, then development. Values are AES-256-GCM at rest and injected at git build time (and into the SSR container). Redirects, rewrites, and headers run before HTML. Optional Speed Insights collects LCP/INP/CLS/TTFB.

Until wildcard DNS is live, the same site answers at https://tinyzipper.com/hosted/acme. Attach a custom domain when you want production on your own hostname.

Use cases

Concrete ways teams use this service on day one.

Set it up in the dashboard

Dashboard → Services → The Stage. Connect a site name, branch, and public git repo. Copy the webhook once into GitHub or GitLab.

Publish an HTML deploy, or Build from git. Add production/preview env vars, and set redirects. Promote a previous sha to roll back.

API

Control-plane: GET|POST|DELETE /api/v1/hosting · /api/v1/hosting/deploys · /api/v1/hosting/env · /api/v1/hosting/routes. Send Authorization: Bearer tz_live_YOUR_TOKEN.

Creates count against the plan quota. A 402 plan_limit means you are at the cap — upgrade or delete an unused resource.

curl -sS -X POST https://tinyzipper.com/api/v1/hosting \
  -H "Authorization: Bearer tz_live_YOUR_TOKEN" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{"name":"www","branch":"main"}'

curl -sS -X POST https://tinyzipper.com/api/v1/hosting/deploys \
  -H "Authorization: Bearer tz_live_YOUR_TOKEN" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{"site_id":"SITE_ID","branch":"main","target":"production"}'

const res = await fetch("https://tinyzipper.com/api/v1/hosting", {
  method: "GET",
  headers: {
    Authorization: `Bearer ${process.env.ZIPPER_TOKEN}`,
    "Content-Type": "application/json"
  }
});
const json = await res.json();
if (!res.ok) throw new Error(json.error ?? res.statusText);
console.log(json);

Tips

Pin production to main or production. Do not auto-deploy from feature branches.

You do not need a second domain to start. sites.tinyzipper.com (or /hosted/{workspace} on tinyzipper.com) is enough. A dedicated domain such as tinyzipper.dev is optional later for cookie isolation, the way Cloudflare uses pages.dev instead of cloudflare.com.

Store secrets as production env vars. Preview inherits them and can override.

• ▸SOC 2
• ▸Git-signed
• ▸AES-256-GCM

Runbook

The www site is live at {workspace}.sites.tinyzipper.com. Other names are {name}--{workspace}.sites.tinyzipper.com. Pin the production branch. Env vars layer preview over production. Redirects apply before HTML. Roll back by promoting a previous deploy sha.