Origin

Where the edge fetches uncached content. ViaductCDN supports two origin classes:

• Clearnet origin — any HTTP/HTTPS server reachable on the public internet. Available on Pro and Business tiers.
• .onion origin — a Tor hidden service. Required on Free; available on every tier. The edge fetches over Tor; neither end of the circuit knows the other's IP.

Status: skeleton

Full content lands in a follow-up pass. See the .onion-as-origin how-to and clearnet-as-origin how-to for setup walkthroughs.

Origin authentication

You can lock origin access down to:

• Bearer token — edge sends Authorization: Bearer <secret> on every origin fetch
• Egress-IP allowlist — for clearnet origins only; restrict at the origin firewall to our published egress IPs
• mTLS — Business tier; client certs issued from our CA

Origin secrets are uploaded via signed URL and stored in Azure Key Vault. They are never shown in the UI after save.