Edge PoP Ingress & Routing Topology
Technical architecture, protocol demultiplexing, and canonical traffic leg rationale for TestPR enterprise edge nodes (vertical: CI/CD Build Artifact & Package Distribution Mirror).
1. Canonical Traffic Legs Rationale
To satisfy hermetic build execution demands, each PoP deploys four specialized traffic legs:
Remote Cache CAS ByteStream: cache.runner-ru2.test-pr.space
Technical Role: Remote execution content-addressable storage.
Rationale: High-throughput byte-level artifact streams supporting action cache (AC) and content-addressable storage (CAS) protocol exchanges. Operates over persistent HTTP/2 sessions with multiplexed frame flow control to saturate physical line-rate interfaces.
Cluster Mesh Artifact Sync: sync.runner-ru2.test-pr.space
Technical Role: High-speed cluster artifact synchronization.
Rationale: Low-latency inter-node replication mesh utilizing modern QUIC / UDP 443 transport. Enables rapid delta propagation between geographically distributed edge runners without head-of-line blocking.
Build Artifact & Package Mirror: repo-ru2.test-pr.space
Technical Role: Static build artifact and package distribution mirror.
Rationale: Publicly accessible distribution mirror deployed behind Anycast CDN caching. Optimized for partial content downloads (HTTP 206 Range requests) for compiler toolchains and runtime tarballs.
Build Runner Coordinator: api.runner-ru2.test-pr.space
Technical Role: CI/CD worker authentication and status.
Rationale: Cryptographically authenticated control plane. Manages runner node registration, mTLS token validation, dynamic capacity scheduling, and health heartbeats. Enforces strict HTTP 401 Unauthorized for invalid tokens.
2. Ingress & Routing Demultiplexing Topology
Ingress packet flow showing TLS SNI demultiplexing and protocol separation across web ports TCP 443 and UDP 443:
[Edge Client / Build Runner / Ingest Device]
│
├── TCP Port 443 (TLS with SNI Demux)
│ ▼
│ Edge Ingress Gateway / CDN Router
│ ├── SNI: cache.runner-ru2.test-pr.space ───> Ingress Stream Processor (HTTP/2 ByteStream)
│ ├── SNI: api.runner-ru2.test-pr.space ───> Diagnostic / Management API (401 Auth Required)
│ └── SNI: runner-ru2.test-pr.space ───> Node Status & Telemetry Origin
│
├── UDP Port 443 (QUIC)
│ ▼
│ Real-Time Transport Engine (QUIC) for sync.runner-ru2.test-pr.space
[Public Consumers / CDN Traffic]
│
└── HTTPS Port 443 (External CDN / Anycast)
▼
CDN Edge Origin (3rd-level: repo-ru2.test-pr.space) ───> Edge Cache / Asset Storage (Range 206)
3. Authentication & Rate Limits Specification
Granular authorization schemes and rate limiting parameters enforced at the ingress layer:
| Target Leg | Port / Protocol | Authentication Scheme | Rate Limiting & Transport Policy | Unauthenticated Response |
|---|---|---|---|---|
cache.runner-ru2.test-pr.space |
TCP 443 / HTTPS | Worker Session Token / mTLS | Unthrottled transport (HTTP/2 ByteStream) | HTTP 403 Forbidden |
sync.runner-ru2.test-pr.space |
UDP 443 / QUIC | Cluster Mesh Auth PSK | Unthrottled transport (QUIC / HTTP/3 Real-Time Transport) | Silent Drop / Connection Reset |
repo-ru2.test-pr.space |
TCP 443 / HTTPS | Public Anonymous Read | 1,000 req/min per IP (HTTP 206 Partial Content / Cache) | HTTP 429 Too Many Requests |
api.runner-ru2.test-pr.space |
TCP 443 / HTTPS | Cryptographic Bearer Token | 120 req/min per Bearer token | HTTP 401 Unauthorized |
4. Public Decoy Manifests & Artifact Verification
The static mirror serves build toolchains with cryptographic SHA-256 validation sums:
Package Manifest Catalog
The catalog is indexed in JSON format at dist/v1/pkg/packages.json accompanied by authoritative cryptographic checksums at dist/v1/pkg/SHA256SUMS.
curl -sSfL "https://repo-ru2.test-pr.space/dist/v1/pkg/packages.json" | jq .
curl -sSfL "https://repo-ru2.test-pr.space/dist/v1/pkg/SHA256SUMS" | sha256sum -c