Edge footprint
35+
Anycast PoPs. One hostname, announced everywhere.
Apoxy:// Solutions
One front door for every origin
Connect via anycast from anywhere and let tunnels route to your services.
01ShapeOne front door
Reliably connect across platforms and providers.
Scattered capacity is becoming the new norm. Our global load balancer can give you a single control plane across CoreWeave, Lambda, RunPod, AWS, GCP, or anywhere your machines are.
02MechanismAnycast
Programmatic proxy-based routing.
Our proxy behind anycast can change routes nearly instantly while DNS-based GSLB implementations only change their answer and rely on resolvers, stub caches, and TTLs that are out of your control.
Fail an origin
Apoxy · edge routing
Steady
Every PoP is forwarding to its closest origin. Health checks are HTTP or TCP probes against the Backend's endpoints.
DNS failover · record TTL
--:--
Idle. Fail an origin to start the clock a DNS-based setup would be running instead.
03WiringGateway API
Connect from anywhere.
Every origin dials out to the edge and stays connected, so a GPU box in a neocloud, a VPC in us-east-1, or your colo's rack can all join the same pool. No platform specific products required.
Each origin runs a tunnel client
Outbound QUIC. No inbound rule, no public IP.
One Backend lists every origin
Endpoints are just tunnel names. Apoxy health-checks them over HTTP or TCP and drops the unhealthy ones from the pool.
One route binds the hostname
HTTPRoute, or TCPRoute and TLSRoute when the traffic is not HTTP. Weighted backendRefs give you canaries and gradual scale ups.
Your zone points at the edge
CNAME to cname.apoxy.net, or delegate the zone. TLS is issued through ACME and the record never changes again.
origins / global.yamlFIG. 02
# Three origins, three clouds, one pool. apiVersion: core.apoxy.dev/v1alpha2 kind: Backend metadata: name: app-origins spec: protocol: h2 endpoints: - fqdn: us-east.tun.apoxy.net - fqdn: eu-west.tun.apoxy.net - fqdn: ap-southeast.tun.apoxy.net --- apiVersion: gateway.apoxy.dev/v1 kind: HTTPRoute metadata: name: app spec: parentRefs: - name: default hostnames: - "app.example.com" rules: - backendRefs: - kind: Backend name: app-origins port: 8080
04QuestionsFAQ
Do my origins need public IPs?
No. Each origin runs a tunnel client that opens an outbound QUIC connection to the edge, so it can sit entirely in a private subnet. If it can connect to the internet, it can be an origin.
How does traffic pick a PoP?
Anycast. The same addresses are announced from every PoP, so a client's packets land at whichever one the internet's routing considers closest. Tunnel clients pick their edge by measuring latency to our PoPs.
Can I keep my current DNS provider?
Yes. The CNAME model leaves you in control of your zone. You simply point a hostname at {domain}.cname.apoxy.net and Apoxy will route traffic and issue certificates on your behalf. You can also delegate a whole zone with DomainZone and DomainRecord if you would rather manage records through the same API as everything else.
How do canaries and percentage-based rollouts work?
The HTTPRoute's backendRefs array holds a weight per backend. Rolling out from 10% to 100% is done simply by changing those integers.
Is this a CDN?
No. We are focused on networking, not storage. We handle ingress and traffic routing via anycast IPs, health-checked backends, Gateway API rules, and optional edge compute on the request path when you want to rewrite or shape traffic before it reaches an origin.
Stop failing over in DNS.
One hostname, every origin you run, and a failover path that does not depend on somebody else's resolver cache. 100 GB free to start.