The Moat

What it is

The Moat is application-layer DDoS on Zipper. If one IP sends too many HTTP requests, Zipper answers 429. It does not swallow raw network packets.

Cloudflare analogue: Cloudflare DDoS (HTTP only — not Magic Transit). SLA 99.9% · p99 3ms. Operators watch the Attack journal and Watchtower flood.absorb events. Admins change absorb policy.

• ▸Cap requests per IP
• ▸On by default
• ▸429 when someone floods
• ▸Written in Watchtower

How it works

The Moat sits in front of The Keep on Zipper. Floods are per-IP HTTP caps that return 429. Packets at L3/L4 are not absorbed.

Sensitivity maps to the request cap. Always-on is the default.

Attacks appear in the Moat journal and Watchtower.

Use cases

Concrete ways teams use this service on day one.

Set it up in the dashboard

Dashboard → Services → The Moat. Leave always-on on. Review the attack journal after an incident.

API

Control-plane: GET /api/v1/watchtower/events?service=moat. Send Authorization: Bearer tz_live_YOUR_TOKEN.

Creates count against the plan quota. A 402 plan_limit means you are at the cap — upgrade or delete an unused resource.

curl -sS https://tinyzipper.com/api/v1/watchtower/events?service=moat \
  -H "Authorization: Bearer tz_live_YOUR_TOKEN"

const res = await fetch("https://tinyzipper.com/api/v1/watchtower/events?service=moat", {
  method: "GET",
  headers: {
    Authorization: `Bearer ${process.env.ZIPPER_TOKEN}`,
    "Content-Type": "application/json"
  }
});
const json = await res.json();
if (!res.ok) throw new Error(json.error ?? res.statusText);
console.log(json);

Tips

Raise sensitivity only during a confirmed flood, then return to medium.

• ▸Application-layer
• ▸Global Server

Runbook

Keep always-on enabled. The Moat is an HTTP per-IP cap on Zipper, not L3/L4 absorb.