Start here
What is not Cloudflare or Neon scale
Named services map Cloudflare- and Neon-shaped jobs onto multi-layered Global Server nodes. This page is the substrate catalog: what those nodes do not run, will not fake, and could still ship without claiming Cloudflare or Neon scale.
This is honest production on multi-layered Global Server nodes: application-layer DDoS and WAF, in-process cache, DNS-JSON (not port 53), and image delivery (not transcoding).
Not this substrate
8
Needs a global packet fabric, GPU cluster, or storage/compute split Zipper does not run.
Honest refusal
12
The analogue exists so you can map a skill. Zipper will not fake the missing machine.
More Global Server nodes
3
Another Global Server node can shrink the gap.
Shippable here
3
Could land in the Zipper process without claiming Cloudflare or Neon scale.
Not this substrate
Needs a global packet fabric, GPU cluster, or storage/compute split Zipper does not run.
| Analogue | Zipper runs | Missing scale |
|---|---|---|
Anycast PoP map cloudflare · network | Unicast Global Server nodes. Visitors who point A at tinyzipper.com land on that address. | Hundreds of anycast interchanges, Anycast BGP, Maglev-style nearest PoP. |
Magic Transit / L3–L4 absorb cloudflare · network · moat | The Moat: per-IP HTTP request cap on Zipper that returns 429. | Packet scrubbing, SYN-flood absorb, BGP advertisement of customer prefixes. |
Workers V8 isolates cloudflare · runtime · functions | Edge Functions: timed node:vm on Zipper, default 30ms CPU, 32 KiB source. | V8 isolate farm, bindings (KV, D1, R2, Durable Objects), 30s+ wall time on paid. |
Workers AI / GPU LLM farm cloudflare · runtime · ai | Edge AI: zip-fast / zip-large / embed-v1. Text and large compose via Cloudflare Workers AI free models when CLOUDFLARE_ACCOUNT_ID + token are set; otherwise Zipper corpus retrieval on CPU. | Rented GPUs, general chatbot, model garden. |
Cloudflare Durable Objects / Neon / Firebase RTDB / Supabase Realtime bus Cloudflare + Neon · data · cellar | The Cellar climate hatch emits on this Zipper process. Opening a chamber returns the cool snapshot the seal can see, then write / unwrite / hitch (BEGIN/COMMIT as one beat) / draft (X-Cellar-Tx) / occupancy / whisper. RLS still filters. 128 hatches per cellar. | A global pub/sub, cross-region ordering, millions of concurrent sockets. |
Neon storage/compute split neon · data · cellar | Encrypted overlay rows in shared tables. Queries load referenced tables (JOIN + FK), not the whole cellar. Snapshots copy the resolved overlay onto an independent branch. WAL is an append-only mutation journal (kind, table, pk — no row bodies). | Safekeeper + pageserver, copy-on-write storage pages, scale-to-zero compute, WAL replay / PITR. |
Spectrum (arbitrary TCP/UDP) cloudflare · network | HTTP(S) on Zipper, media from object storage, Cellar wire on loopback 15432. | Proxy Minecraft, SSH, or random TCP through an anycast edge. |
Postgres PGWire / Cellar wire adapter Cloudflare + Neon · runtime · wire | Zipper Wire is AI automation. Cellar exposes Postgres via its own wire/REST adapters. Different products, different URLs. | SQL protocol compatibility for Wire. |
Honest refusal
The analogue exists so you can map a skill. Zipper will not fake the missing machine.
| Analogue | Zipper runs | Missing scale |
|---|---|---|
Authoritative DNS on UDP/TCP 53 cloudflare · protocol · herald | The Herald stores records and answers DNS-JSON at GET /dns-query. | Nameservers, registrar NS cutover, DNSSEC, AXFR. |
Polish / Image Resizing / AVIF cloudflare · media · gallery | The Gallery serves original bytes from Zipper object storage; The Crown may cache them. | On-the-fly resize, format convert, EXIF strip. |
Stream encode + adaptive HLS cloudflare · media · video | Video Delivery stores and plays the file you PUT in Zipper object storage. | Transcode ladder, DRM, captions pipeline, global ingest. |
Pages Functions / SSR Node cloudflare · runtime · hosting | Site Hosting builds git repos to static files. Next.js needs output: "export". | Long-running Node origin, server components at the edge, `pages.dev`-scale isolation. |
Stock Postgres :5432 neon · data · cellar | DATABASE_URL talks to Zipper’s sealed-query PGWire adapter (127.0.0.1:15432). | Host Postgres parser, Postgres roles, extensions, superuser. |
Detonation sandbox / full AV engine cloudflare · runtime · guard | Palace Guard: hashes, EICAR, canary, shells, RLO/ADS names, MIME polyglots, SVG/PDF/GIF smuggle, ZIP headers — no inflate. Live cordon on Gallery/Archives/Video PUT, Site Hosting HTML, inbound mail (subject/preview, not MIME parts), and function source. Quarantined hashes held on serve. Git-built trees are not walked. | Emulation sandbox, signature cloud, exploding zip bombs safely at hyperscale. |
Firebase Cloud Messaging / APNs Cloudflare + Neon · data · armory | The Armory live channel is SSE on this Zipper process. | FCM, APNs, a global fan-out fabric. |
Kubernetes twenty-replica control plane Cloudflare + Neon · ops · armory | Twenty Docker racks on this Global Server node. One duty per rack. Private bridge. Not a cluster manager. | etcd, schedulers, multi-zone replica sets. |
Twilio / Amazon Connect PSTN Cloudflare + Neon · media · chamberlain | Zipper Pilot voice is WebRTC on this Zipper process, with an HTTPS media relay when UDP is blocked. Tab callback when an agent is free. | PSTN DIDs, SIP trunks, global TURN anycast. |
Intercom Fin / Zendesk AI GPU agents Cloudflare + Neon · runtime · chamberlain | Zipper Pilot retrieves hall scrolls, then composes with Cloudflare Workers AI free-tier models when configured (falls back to CPU stitching). Still refuses off-corpus invention. | GPU LLM farm, general chatbot. |
Zapier / Make multi-tenant automation farms Cloudflare + Neon · runtime · wire | Zipper Wire runs versioned wires on this Global Server node with Palace RBAC, HITL approvals, and SSRF-guarded HTTP. It orchestrates Functions, Jobs, and grounded AI — it does not host a global connector marketplace. | Thousands of SaaS connectors, multi-region workflow fleets, visual canvas editors. |
Temporal / Cadence durable workflow clusters Cloudflare + Neon · ops · wire | Linear wires (max 20 steps), in-process runs with retries and dead status, schedule drain via cron secret. Durable enough for ops automations on this process — not a multi-service Temporal cluster. | Worker fleets, activity task queues across regions, long-running multi-day saga orchestration. |
More Global Server nodes
Another Global Server node can shrink the gap.
| Analogue | Zipper runs | Missing scale |
|---|---|---|
PoP CDN cache cloudflare · ops · crown | The Crown: in-process Map on Zipper, 800 objects, TTL + SWR, gzip/brotli, local disk beside the process. | Disk/SSD cache in every city, regional purge, a PoP network. |
Geo / latency load balancing cloudflare · network · drawbridge | The Drawbridge health-checks origin pools across Global Server nodes. | Steer by continent, steering via anycast, pool diversity across 300 cities. |
R2 global replication cloudflare · data · archives | The Archives: objects in Zipper object storage, metadata on the control plane, AES-256-GCM, HMAC URLs. | Multi-region copies, public buckets with CF-scale egress, S3-complete API. |
Shippable here
Could land in the Zipper process without claiming Cloudflare or Neon scale.
| Analogue | Zipper runs | Missing scale |
|---|---|---|
HTTP/3 / QUIC at the edge cloudflare · protocol · vault | Snippets listen 443 quic + Alt-Svc; UFW allows UDP 443. Zipper enables QUIC when nginx is built with ngx_http_v3_module, otherwise HTTP/2. Unicast addresses. | A loaded http_v3_module in production, QUIC advertised from many cities. |
Transactional email sending + inbound routing cloudflare · ops · email | Emails verifies customer domains (SPF include:_spf.tinyzipper.com, DKIM, DMARC), signs outbound with nodemailer+Postfix on Global Server nodes, and still stores inbound over HTTP. | Shared IP warm-up at ESP scale, click/open tracking pixels, dedicated marketing campaigns. |
Full SQL surface (windows, extensions, pgvector…) neon · data · cellar | Restricted Cellar dialect: tables, policies, seals, REST, RPC, frozen snapshots, query journal. Two JOINs (LEFT / INNER / embed), GROUP BY, HAVING, COUNT/SUM/AVG/MIN/MAX, DISTINCT, NOT, BETWEEN, jsonb ->> / @>, BEGIN/COMMIT as one script (8 statements) or as separate PGWire/HTTP statements with X-Cellar-Tx (60s overlay), ORDER BY, LIMIT. PostgREST not./cs plus Prefer: count=exact. | Arbitrary SQL, contrib extensions, stored procedures on the host, window functions, pgvector. |
Shape we already match
These jobs exist in production on Zipper. They are still not Cloudflare or Neon scale.
- WAF HTTP rules
The Keep evaluates managed and custom expressions before origin. It is application-layer, which is also what Moat does not pretend about packets.
- Turnstile Siteverify JSON
Portcullis is first-party: widget, proof-of-work, one-time token, POST /api/portcullis/v1/siteverify. Sensitive Zipper actions use it.
- DNS-over-HTTPS JSON (application/dns-json)
GET /dns-query answers stored Herald records with Status, Question, Answer, and flags. Proxied A returns the Zipper unicast address. Not UDP/TCP 53, not a recursive resolver.
- Image delivery without Polish
PUT originals, GET /_gallery/{key}. /cdn-cgi/image/{params}/{key} is accepted; transform params become X-Zipper-Requested and are not applied.
- API rate limits
The Scepter caps public APIs on Zipper. Pair with Portcullis on login. This is not Cloudflare API Shield ML.
- Access identity proxy
The Throne Room puts HMAC cookies in front of a private origin. The origin should not also have a public A record.
- Firebase Auth + Firestore client SDK
Skill map only. The Armory issues spent-cartridge warrants (zw.…), hatch-bound sessions, and revisioned musters. Writes are not reusable JWTs. Live is SSE on this node, not FCM.
- cloudflared outbound Tunnel
Origin Connect dials Zipper outbound. No inbound hole. The connector is an outbound dial to Zipper.
- Waiting Room
Visitor Queue parks excess sessions on Zipper when a path exceeds its budget. Included, not a separate SKU.
- Intercom Messenger + Fin
Drop /chamberlain/v1/hall.js. Pilot learns the host site, cites scrolls, records gaps instead of inventing, and gives agents the page + thread. Voice is Starter+. Not a GPU Fin clone.
- Zapier / Temporal skill map
Zipper Wire: versioned wires, grounded AI, HITL approvals, SSRF-guarded HTTP on this node. Not a connector marketplace, not Temporal, not Cellar PGWire.
- Queues
Job Queues are durable rows with AES-256-GCM payloads. At-least-once, dead-letter, not a global mesh.
- HTTP analytics
Watchtower is workspace-scoped request / WAF / Moat / Portcullis telemetry. Log push is a plan entitlement, not a SIEM product.
- Warm cache across restarts
The Crown writes the Map to ZIPPER_CROWN_CACHE_PATH (default /opt/tinyzipper/var/crown-cache.json). Restart rehydrates TTL/SWR entries. This is one disk on Zipper, not a PoP.
- Point-in-time snapshot branch
POST /snapshots copies the resolved overlay (schema + visible rows) onto a parent-less branch. Later writes on main do not leak into the freeze. Restore forks that freeze. Not Neon PITR.
- Query + mutation journal
Sealed statements append cellar_query_log. Mutations append cellar_wal with kind, table, and pk only — never the document. The journal is not a safekeeper.
- App users (email/password + seal)
POST /auth/v1/signup and /auth/v1/token mint a 1h authenticated seal with auth.uid(). Zipper does not send the recovery email — a service seal can mint a 15-minute recovery token. Not Google OAuth, not dashboard Auth.
- Chat rooms on a sealed overlay
New cellars provision profiles, rooms, room_members, and messages with membership RLS. Climate notifies members with the document. Occupancy expires in 45s. Not a world bus.
- Live chamber (snapshot + hitch)
GET /live/v1/{chamber} returns climate, overlay, occupancy, and visible docs. SSE then speaks write, unwrite, hitch, draft, occupancy, whisper. A hitch is a committed BEGIN as one beat — not row-at-a-time notify, not Firebase always-live. 128 hatches on this Zipper process.
- Agent setup (URL + seal → schema)
Paste CELLAR_URL and a schema seal. GET /agent (or /llms.txt) is the machine card. PUT /setup applies a climate blueprint: chambers, owner policies, optional seed. Encryption and RLS stay on. Not stock migrations, not a Supabase MCP.
- phpMyAdmin export → Cellar chambers
POST /import accepts phpMyAdmin SQL, CSV, or JSON. CREATE TABLE and INSERT land as chambers. reset_logins=1 registers imported emails/phones so the next sign-in returns password_reset_required plus a recovery token. Zipper does not send mail. Views, triggers, procedures, and ENGINE options are skipped. Caps: 2 MB, 10,000 rows, 40 tables, 2,000 logins. Not stock MySQL.
- Workers Cron Triggers
Five-field UTC cron on function_scripts. POST /api/v1/functions/drain with ZIPPER_CRON_DRAIN_SECRET runs due jobs; edge traffic also ticks opportunistically. scheduled(event) or fetch on cron POST. Not a global scheduler mesh.
- Workers env / bindings
env exposes ZONE_HOST, GATE_BASE, and *_LIVE flags for Archives, Jobs, Cellar, Email, AI. Honest metadata — not KV, D1, or R2. compatibilityDate gates the surface.
- (none at Cloudflare)
Palace Guard is Zipper’s edge antivirus. Cloudflare has no analogue; the gap is detonation, not existence.
How to use the catalog
A site that needs Magic Transit
You are absorbing volumetric L3 and also want Portcullis + workspace billing.
- Keep packet absorb where it lives. Zipper Moat will not take the NIC.
- Point web hostnames at tinyzipper.com for Keep, Crown, and Portcullis on HTTP.
- Do not change nameservers expecting The Herald to speak port 53.
An app that needs Neon's pageserver
You want copy-on-write storage clones and stock Postgres, plus Zipper's hatch.
- Use Neon or RDS for the engine that must be Postgres.
- Use The Cellar when the point is sealed queries, capability seals, and fail-closed Origin.
- Do not send tenant SQL expecting it to hit host Postgres. It will not.
Next: Cloudflare in front of Zipper · All docs · Create a free account