Why we carry connections over standard SSH
Long-term stability, a mature ecosystem, easy auditing and controllable permissions: we carry our tunnels over standard SSH and built our own user-level SSH service for the nodes.
Read article →Chained routing: what one request goes through, from nearby acceleration to an IDC exit
From the moment you press Enter to Gemini returning its first token: which nodes the request passes and what decisions are made.
The scenario
You run this in your terminal:
curl https://generativelanguage.googleapis.com/v1beta/models -H "x-goog-api-key: $KEY"Step 0: the request is handed to CoderBoost
You've set HTTPS_PROXY=http://127.0.0.1:7898, so curl hands the request to the local proxy. In TUN mode this happens at the system level.
Step 1: look up the table
In its locally cached route policy, the client finds that generativelanguage.googleapis.com uses "AI Compliant Exit": edge node → IDC exit. The policy is signed by the server, carries a version number and syncs when you connect.
Step 2: enter nearby
The request travels through an encrypted tunnel to a nearby edge node. The tunnel is carried over the standard SSH protocol, and the node runs our own user-level SSH service: it only accepts user credentials and is fully isolated from the system admin channel.
Step 3: the node checks authorization
The edge node checks your authorization first: are your device credentials valid, and does your plan allow the AI Compliant Exit route? The node keeps no user database; it relies on the access lease synced from the control plane.
Step 4: chained forwarding
The edge node forwards the request to the IDC exit assigned to you.
Step 5: reaching the target
Google's servers see the IDC exit's IP and respond normally. The response returns along the same path.
What other requests are doing at the same time
- Your browser browsing GitHub: only reaches the edge node, no exit involved.
- Off-list requests: stay on your own network and pass through no node at all.
If the IDC exit goes down
The client marks the resource as "Paused" and tells you why, instead of quietly sending it out from the edge node or another exit. Once the server's health checks spot the failure, the exit is replaced or downgraded, and traffic resumes automatically when it recovers.
If you are banned or change your password
The control plane updates your authorization in the same transaction and notifies every node through the event stream. Once the nodes have persisted the change and acknowledged it, your authorization is invalid on all of them at once.