Site Hosting

What it is

Site Hosting connects a git repo. Zipper builds it, gives each branch a preview URL, and lets you roll back to an earlier deploy. Secrets sit encrypted. Attach your own domain when you are ready.

Cloudflare analogue: Cloudflare Pages / Vercel. SLA 99.95% · p99 40ms. Admins connect the repository. Viewers may inspect preview URLs.

• ▸Git deploys
• ▸Preview URLs
• ▸Instant rollback
• ▸Encrypted env vars

How it works

Connect a public GitHub or GitLab HTTPS repo. The www site for workspace acme is https://acme.sites.tinyzipper.com (Zipper’s pages.dev / vercel.app). Zipper shows a webhook URL once — paste it under repo Settings → Webhooks, and paste the last path segment as the secret. Push queues a build on Zipper. Next.js needs `output: "export"`; the builder publishes static files, not an SSR Node server.

Each deploy is immutable. Append ?d={sha} for a unique URL. Promote a previous sha to roll production back instantly.

Environment variables layer like Vercel: production, then preview overrides, then development. Values are AES-256-GCM at rest and injected at git build time. Redirects, rewrites, and headers run before HTML. Optional Speed Insights collects LCP/INP/CLS/TTFB.

Until wildcard DNS is live, the same site answers at https://tinyzipper.com/hosted/acme. Attach a custom domain when you want production on your own hostname.

Use cases

Concrete ways teams use this service on day one.

Set it up in the dashboard

Dashboard → Services → Site Hosting. Connect a site name, branch, and public git repo. Copy the webhook once into GitHub or GitLab.

Publish an HTML deploy, or Build from git. Add production/preview env vars, and set redirects. Promote a previous sha to roll back.

API

Control-plane: GET|POST|DELETE /api/v1/hosting · /api/v1/hosting/deploys · /api/v1/hosting/env · /api/v1/hosting/routes. Send Authorization: Bearer tz_live_YOUR_TOKEN.

Creates count against the plan quota. A 402 plan_limit means you are at the cap — upgrade or delete an unused resource.

curl -sS -X POST https://tinyzipper.com/api/v1/hosting \
  -H "Authorization: Bearer tz_live_YOUR_TOKEN" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{"name":"www","branch":"main"}'

curl -sS -X POST https://tinyzipper.com/api/v1/hosting/deploys \
  -H "Authorization: Bearer tz_live_YOUR_TOKEN" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{"site_id":"SITE_ID","branch":"main","target":"production"}'

const res = await fetch("https://tinyzipper.com/api/v1/hosting", {
  method: "GET",
  headers: {
    Authorization: `Bearer ${process.env.ZIPPER_TOKEN}`,
    "Content-Type": "application/json"
  }
});
const json = await res.json();
if (!res.ok) throw new Error(json.error ?? res.statusText);
console.log(json);

Tips

Pin production to main or production. Do not auto-deploy from feature branches.

You do not need a second domain to start. sites.tinyzipper.com (or /hosted/{workspace} on tinyzipper.com) is enough. A dedicated domain such as tinyzipper.dev is optional later for cookie isolation, the way Cloudflare uses pages.dev instead of cloudflare.com.

Store secrets as production env vars. Preview inherits them and can override.

• ▸SOC 2
• ▸Git-signed
• ▸AES-256-GCM

Runbook

The www site is live at {workspace}.sites.tinyzipper.com. Other names are {name}--{workspace}.sites.tinyzipper.com. Pin the production branch. Env vars layer preview over production. Redirects apply before HTML. Roll back by promoting a previous deploy sha.