Functions & immutable versions
Create a function, deploy an immutable version (optionally promoting it), list versions, and roll the active pointer back to any earlier version — deploys are append-only, rollback is instant.
Workers-equivalent + CDN
Functions with immutable versions, rollback and a real WASM datapath — plus tiered cache and edge WAF.
What it does
SS-27 is both the CDN and the compute plane on our own PoP fleet. Deploy functions as immutable versions and roll back instantly; wire http / cron / cache-miss triggers; place across PoPs with a pending→active rollout; bind an R2 bucket, KV namespace or env; and execute a real WASM module (not only the deterministic reference model). Underneath, class-driven tiered caching, surrogate-key purge and an edge WAF at parity with the gateway serve the assets the functions produce.
Sub-capabilities
Create a function, deploy an immutable version (optionally promoting it), list versions, and roll the active pointer back to any earlier version — deploys are append-only, rollback is instant.
Bind route patterns and triggers — http (host + path glob, longest-match wins), cron, or cache-miss — and resolve a host+path to its owning function at request time.
Place a function on all or a named subset of PoPs, then advance a pending→active rollout across the fleet, watching effective placement and rollout state.
Bind an R2 bucket, a KV namespace or an env value to a function; secrets are redacted on read; remove a binding by id.
Upload real wasm bytes for a version and execute the active version's module, alongside the deterministic reference-model invoke; inspect executions and their logs; set runtime limits/policy clamped to bounds.
Class-driven caching (immutable-asset, api-cacheable, status, registry-blob), a regional shield that collapses duplicate misses, surrogate-key purge (≤5s global), signed-URL verification, and an edge WAF at gateway parity.
Endpoints
A representative slice of the 45 operations on SS-27. Base: https://api.edge.nexocloud.io/api/v1. Auth is an SS-01 bearer token plus X-Tenant-Id.
/api/v1/functionsCreate an edge function./api/v1/functions/{name}/deployDeploy an immutable version (optionally promote)./api/v1/functions/{name}/versionsList a function's immutable versions./api/v1/functions/{name}/rollbackRoll the active pointer back to an earlier version./api/v1/functions/{name}/routesBind a route pattern / trigger to a function./api/v1/compute/resolveResolve host+path to the owning function (longest glob wins)./api/v1/functions/{name}/placementPlace a function on all or a named subset of PoPs./api/v1/functions/{name}/rolloutAdvance the pending→active PoP rollout./api/v1/functions/{name}/bindingsBind an R2/KV/env resource to a function./api/v1/functions/{name}/wasmUpload real wasm bytes for a version./api/v1/functions/{name}/execExecute the active version's real wasm module./api/v1/functions/{name}/metricsPer-function metrics summary./api/v1/classes/{class}Upsert a cache class policy./api/v1/purgeSurrogate-key / path purge across the fleet./api/v1/waf/classes/{class}Upsert an edge WAF class./api/v1/pops/{name}Upsert a PoP the fleet can place functions on.Worked example
Ship an immutable version, bind an R2 bucket, route it, roll it out to the fleet — then roll back the active pointer in one call if the new version misbehaves.
# 1. Create a function and deploy an immutable version
curl -X POST "$BASE/functions" -H "$AUTH" -H "$TENANT" \
-d '{"name":"assets-router"}'
curl -X POST "$BASE/functions/assets-router/deploy" -H "$AUTH" -H "$TENANT" \
-d '{"code":"export default { fetch(req, env){ /* serve from R2 */ } }","promote":true}'
# → { "version": "v7", "active": "v7" }
# 2. Bind the R2 bucket and route http traffic to it
curl -X POST "$BASE/functions/assets-router/bindings" -H "$AUTH" -H "$TENANT" \
-d '{"kind":"r2","name":"ASSETS","ref":"site-assets"}'
curl -X POST "$BASE/functions/assets-router/routes" -H "$AUTH" -H "$TENANT" \
-d '{"trigger":"http","host":"cdn.acme.io","path":"/assets/*"}'
# 3. Place + roll out across the PoP fleet (pending → active)
curl -X POST "$BASE/functions/assets-router/placement" -H "$AUTH" -H "$TENANT" \
-d '{"pops":"all"}'
curl -X POST "$BASE/functions/assets-router/rollout" -H "$AUTH" -H "$TENANT"
# → { "rollout": "active", "pops_active": 9, "pops_total": 9 }
# 4. Bad version? Roll the active pointer back instantly.
curl -X POST "$BASE/functions/assets-router/rollback" -H "$AUTH" -H "$TENANT" \
-d '{"to":"v6"}'
# → { "active": "v6" } # v7 stays on record, immutableVersions are append-only and immutable; rollback flips a pointer, it doesn't redeploy. Placement and rollout are observable state, so a staged fleet rollout can be halted mid-flight.
Architecture placement
SS-27 owns the PoP fleet — it is where cache and compute meet the request. The control plane governs lifecycle, placement, routing and bindings; a V8-isolate/WASM runtime is the production datapath.
Keep exploring
RustFS, productized as public S3/R2 — with zero-egress-to-edge accounting.
Deep-dive →Signed zones, health-based steering, and 99.999% serve-stale through an origin incident.
Deep-dive →Mesh overlay, native WireGuard, full SASE and SD-WAN — unified by the UPO policy compiler.
Deep-dive →Gateway admission and edge WAF at the perimeter; detections-as-code and guard-railed containment behind it.
Deep-dive →PoPs, BGP sessions, anycast policies and failover drills — the GitOps-managed footprint the edge runs on.
Deep-dive →