Create account
Private networks

WireGuard private networks and private origins

Connect servers, admin devices and origins through managed WireGuard networks, with versioned ACLs and origins that are never exposed to the Internet. Included, with no subscription.

Create accountRead the documentation
Private network workspace: WireGuard setup, devices, VPN POP and CLI commands.Private network workspace: WireGuard setup, devices, VPN POP and CLI commands.
cdn.pizza console · demo data

Network, peers and attached POPs

A network has a private CIDR, routes, peers and POP profiles. Pick a CIDR that does not overlap your existing networks, then attach the POPs that need to reach your machines.

Enrollment with a short-lived key and the CLI

A cpn_… enrollment key with limited lifetime and uses enrolls a connector, an admin device or an origin. The WireGuard private key is generated locally and never uploaded.

network:profile writes the profile without enabling it; network:enroll --install can run wg-quick when wireguard-tools is installed; network:refresh updates an existing profile without dropping the tunnel.

Ordered, versioned ACLs

Each rule sets source, destination, protocol, ports, action and order. Every change increments the policy, which is synchronised to the affected POP profiles; a disabled rule stays visible for audit.

Private origins, never exposed

A private origin links a zone, a network, an address and a port, and the POPs able to reach it. If the private path is not ready, the platform blocks the switch rather than falling back to a public address.

Traffic and billing

Private network traffic follows the per-GB price of the POP it uses: it carries no fee on standard and partner POPs priced at 0 CHF/GB.

FAQ

Frequently asked questions

Do I need a proprietary agent?

No. The profile is a standard WireGuard file; the cdn-pizza CLI writes it and can enable it with wg-quick.

What happens if a POP can no longer reach the private origin?

The platform checks that the private path is ready before activation and rejects a configuration that would fall back to a public or unavailable address.

Put your domain behind cdn.pizza

Create an account, add a domain and choose your POPs. No card is required and there is no subscription.

Create account Login
  • No subscription, no card
  • No fee on standard and partner POP traffic
  • Documentation in French, English and German