Networking, CDN & Edge

VPCs, a sovereign mesh, authoritative DNS, edge compute and a PoP fabric you run.

The network plane: VPCs and a zero-knowledge WireGuard mesh with SASE/ZTNA policy, DNSSEC-signed authoritative DNS with health-checked answers, an edge-compute and CDN plane with WAF and cache control, and a CloudPoP fabric where you register the points-of-presence and BGP sessions yourself. The data plane is yours end to end.

Auth is one model across every service here — an SS-01 bearer token plus X-Tenant-Id on every /api/v1 route. Public base https://api.nexocloud.io/api/v1.

4 real backends, 164 operations.

Every path below is a real route from services/<svc>/openapi.json. Each service lists a representative slice of its full contract.

Network / SASE SS-26

82 operations

VPCs, sovereign mesh & SASE — overlays, ZTNA/SD-WAN policy, residency controls and a unified policy compiler.

POST/api/v1/vpcsCreate a VPC.
POST/api/v1/meshCreate a zero-knowledge WireGuard mesh overlay (SDP control plane).
POST/api/v1/sase/ztna/policiesAuthor a default-deny ZTNA access policy.
POST/api/v1/upo/compileCompile the unified policy to ZTNA / SD-WAN / firewall rulesets.
PUT/api/v1/residency/{class}Set a data-residency class constraint.

DNS SS-25

14 operations

Authoritative DNS — zones, DNSSEC ceremonies, health-checked answers and publish control.

POST/api/v1/zonesCreate an authoritative DNS zone.
PUT/api/v1/zones/{zone}/rrsetsUpsert resource record sets.
POST/api/v1/zones/{zone}/dnssec/initInitialise DNSSEC signing for a zone.
GET/api/v1/zones/{zone}/answerResolve a health-checked answer for a name.

Edge SS-27

45 operations

Edge compute & CDN — edge functions, versioned deploys, PoP placement, cache, WAF and signed URLs.

POST/api/v1/functionsCreate an edge function.
POST/api/v1/functions/{name}/deployDeploy an immutable edge-function version.
POST/api/v1/functions/{name}/placementPlace a function across all or a subset of PoPs.
POST/api/v1/purgePurge cached content across the edge.
PUT/api/v1/waf/classes/{class}Configure a WAF ruleset class.

CloudPoP SS-57

23 operations

PoP fabric — points-of-presence, BGP sessions, anycast policies, GitOps changes and capacity forecast.

POST/api/v1/popsRegister a point-of-presence.
POST/api/v1/bgp/sessionsCreate a BGP session.
POST/api/v1/anycast/policies/{id}/failover-drillRun an anycast failover drill with evidence.
POST/api/v1/gitops/changes/{id}/applyApply a GitOps change to the fabric.

A VPC, a mesh and a health-checked DNS answer

Stand up private networking, join devices to a zero-knowledge mesh, and hand out DNS answers that only point at healthy targets — all under one unified policy.

Create the VPCPOST/api/v1/vpcs

Private address space scoped to your tenant.

Build the meshPOST/api/v1/mesh

A WireGuard overlay where the control plane never sees a private key.

Compile policyPOST/api/v1/upo/compile

One unified policy compiles to ZTNA, SD-WAN and firewall rulesets.

Serve DNSGET/api/v1/zones/{zone}/answer

Answers are DNSSEC-signed and gated on target health.

Where it sits in the platform.

Networking, CDN & Edge does not reimplement the platform — it composes it. These are the services it leans on and the seams between them.

Network / SASE (SS-26)

VPCs, the sovereign mesh and the unified policy compiler — 82 operations of network control.

DNS (SS-25)

DNSSEC-signed authoritative zones with health-checked answers.

Edge (SS-27)

Edge functions, CDN cache and WAF placed across the PoP fabric.

CloudPoP (SS-57)

The physical PoP + BGP fabric you register and drain on your terms.