PoPs, blueprints & providers
List and create PoPs from blueprints, register catalogue providers, drain a PoP for a lifecycle transition, and manage a PoP's routes.
The fleet control plane
PoPs, BGP sessions, anycast policies and failover drills — the GitOps-managed footprint the edge runs on.
What it does
SS-57 is the control plane for the physical edge: register PoPs from blueprints and providers, drain them for maintenance, manage BGP sessions and routes (drain, withdraw), author anycast and traffic policies, run failover drills that produce evidence, forecast capacity, and drive it all through GitOps changes with apply and rollback. This is the fleet the SS-27 CDN caches on and SS-25 steers to — honestly smaller than Cloudflare's 330+ cities, but yours and sovereign.
Sub-capabilities
List and create PoPs from blueprints, register catalogue providers, drain a PoP for a lifecycle transition, and manage a PoP's routes.
Create and inspect BGP sessions, drain a session gracefully, and withdraw a route — the anycast reachability primitives, under control.
Author anycast policies and traffic policies, and run a failover drill on a policy that produces a transition plus evidence you can attach to an audit.
Every fleet change is a GitOps change with an explicit apply and rollback — the footprint is managed declaratively, not by hand at 3am.
Read a capacity forecast and fleet usage so PoP growth follows demand and residency zones, not a race for city count.
Endpoints
A representative slice of the 23 operations on SS-57. Base: https://api.edge.nexocloud.io/api/v1. Auth is an SS-01 bearer token plus X-Tenant-Id.
/api/v1/popsList PoPs./api/v1/popsRegister a PoP./api/v1/pops/{id}/drainDrain a PoP (lifecycle transition)./api/v1/pops/{id}/routesManage a PoP's routes./api/v1/bgp/sessionsList BGP sessions./api/v1/bgp/sessions/{id}/drainDrain a BGP session (graceful)./api/v1/routes/{id}/withdrawWithdraw a BGP route./api/v1/anycast/policiesAuthor an anycast policy./api/v1/anycast/policies/{id}/failover-drillRun a failover drill (transition + evidence)./api/v1/traffic/policiesAuthor a traffic policy./api/v1/blueprintsList PoP blueprints./api/v1/gitops/changesOpen a GitOps change./api/v1/gitops/changes/{id}/applyApply a GitOps change./api/v1/gitops/changes/{id}/rollbackRoll back a GitOps change./api/v1/capacity/forecastRead a capacity forecast./api/v1/usageRead fleet usage.Worked example
Fleet changes are declarative and reversible. Drain a PoP, drill failover for evidence, and apply — or roll back — as a GitOps change.
# 1. Open a GitOps change describing the maintenance
curl -X POST "$BASE/gitops/changes" -H "$AUTH" -H "$TENANT" \
-d '{"summary":"drain fra1 for hardware swap"}'
# → { "change_id": "chg_19", "state": "open" }
# 2. Prove failover works first — a drill emits evidence
curl -X POST "$BASE/anycast/policies/pol_eu/failover-drill" -H "$AUTH" -H "$TENANT"
# → { "transition": "fra1→ams1", "evidence_ref": "..." }
# 3. Drain the PoP and its BGP session gracefully
curl -X POST "$BASE/pops/fra1/drain" -H "$AUTH" -H "$TENANT"
curl -X POST "$BASE/bgp/sessions/bgp_fra1/drain" -H "$AUTH" -H "$TENANT"
# 4. Apply the change — reversible in one call
curl -X POST "$BASE/gitops/changes/chg_19/apply" -H "$AUTH" -H "$TENANT"
# → { "state": "applied" } # POST .../rollback restores itThe failover drill produces evidence before the drain, the drain is a clean lifecycle transition, and the whole thing is one GitOps change with a rollback — no manual BGP surgery.
Architecture placement
SS-57 is the substrate the rest of the suite stands on — it is deliberately honest about footprint and grows toward demand and residency, not city count.
Keep exploring
RustFS, productized as public S3/R2 — with zero-egress-to-edge accounting.
Deep-dive →Functions with immutable versions, rollback and a real WASM datapath — plus tiered cache and edge WAF.
Deep-dive →Signed zones, health-based steering, and 99.999% serve-stale through an origin incident.
Deep-dive →Mesh overlay, native WireGuard, full SASE and SD-WAN — unified by the UPO policy compiler.
Deep-dive →Gateway admission and edge WAF at the perimeter; detections-as-code and guard-railed containment behind it.
Deep-dive →