Chained routing: what one request goes through, from nearby acceleration to an IDC exit
From the moment you press Enter to Gemini returning its first token: which nodes the request passes and what decisions are made.
Read article →Why we carry connections over standard SSH
Long-term stability, a mature ecosystem, easy auditing and controllable permissions: we carry our tunnels over standard SSH and built our own user-level SSH service for the nodes.
Four things we care about in a protocol
- Long-term stability: developers need it to work all day and all month, not to look good in a speed-test screenshot.
- Standard and mature: SSH has been in use for thirty years, with mature implementations, thorough audits and a complete toolchain.
- Clear identity: every connection maps to a specific user and device credential.
- Permission isolation: a node's admin access must never be exposed by user connections.
Why not just use the system sshd
The system sshd is designed for logging in to servers: every user is a system account, and its permission boundaries don't suit a large-scale connection service. Our nodes run our own SSH service instead:
- users are not system accounts; they can only open permitted forwards and cannot run commands;
- user credentials are issued and revoked centrally by the control plane, and nodes admit connections based only on access leases;
- the system admin channel is fully isolated from the user service, on a different port with a different set of credentials.
Device credentials: private keys never leave the device
- Every device generates its own key, and the private key is stored only in the local system's secure storage;
- the control plane keeps only the public key, and the database refuses to store private keys;
- credentials rotate regularly, with a brief overlap between old and new so connections aren't interrupted;
- removing a device or changing your password revokes the credentials immediately, on every node.
The result
A connection layer that is standard, mature, auditable and clear about permissions. It doesn't chase anything flashy; it aims for one thing only: once you connect, you forget it's there.