rasp-cdn docs

From invitation to first cache hit.

rasp-cdn is currently invite-only. The customer console, API, and CLI all use the same Rust control plane and publish versioned configuration to every edge.

Private-beta quickstart

  1. Open the single-use invitation link, choose your organization name and slug, and set a password of at least 12 characters.
  2. Enroll a TOTP authenticator and store the ten one-time recovery codes offline.
  3. Create a pull zone with a customer hostname and a public HTTPS origin.
  4. Add the CNAME shown beside the zone, then wait for DNS propagation.
  5. Request the same asset twice and verify a MISS followed by a HIT.
curl -sSI https://assets.example.com/app.js | grep -i x-cache
# x-cache: MISS
curl -sSI https://assets.example.com/app.js | grep -i x-cache
# x-cache: HIT

DNS and TLS

Create a CNAME from the exact zone hostname to the delivery target returned by the API and console. Each edge asks the control plane whether that hostname is an active zone before it may obtain a certificate. Unknown, paused, deleted, or closed-organization hostnames are refused.

The first TLS connection can be slower while a certificate is issued. Keep the CNAME in place so renewal and traffic steering continue to work.

Cache behavior

Successful public responses are cacheable when their status and origin policy permit it. s-maxage wins over max-age, then the zone maximum caps the lifetime. private, no-store, unsupported Vary values, and Set-Cookie responses bypass storage by default.

HIT

Fresh cache

Served from disk with Age, byte ranges, and the zone identifier.

STALE

Background refresh

Stale-while-revalidate serves known content while one collapsed origin request refreshes it.

STALE-IF-ERROR

Origin protection

A known-good object can be served when revalidation fails inside the configured error window.

BYPASS

Safety first

Credentials, non-cacheable origin policy, and unsupported responses do not enter shared storage.

Origin DNS is resolved and checked before connecting. Private, loopback, link-local, documentation, multicast, and reserved addresses are rejected, and every redirect is checked again.

Authentication

Customers use first-party email/password accounts plus mandatory TOTP MFA. Recovery codes are individually hashed and single-use. Browser sessions are opaque, revocable, secure cookies. GitHub OAuth is a separate, locally provisioned staff boundary and cannot create a customer session.

Developer automation uses organization-scoped API keys. The full secret is shown once; the database stores only its digest. Give each integration the smallest set of scopes it needs.

CLI

Build the current beta CLI from source with cargo install --path crates/rasp-cli, then provide an API key and organization ID.

export RASP_API_URL=https://api.rasp-cdn.dev/api/v1
export RASP_API_TOKEN=rasp_live_...
export RASP_ORGANIZATION_ID=019...

rasp status
rasp zones list
rasp zones create --name Assets --hostname assets.example.com \
  --origin https://origin.example.com
rasp purge 019... prefix /releases/2026-09/
rasp usage
rasp audit

Beta limits

The private-beta plan currently includes 10 zones, 10 organization members, and 100 GiB of metered egress. Billing state is provider-neutral and visible in the console, but no payment provider is connected and no card is requested during the beta.