Queue Mode + Lottery Mode
Fair line or equal-odds draw
FIFO position and ETA, or a lottery pool with odds. Switch live from the control room.
Open source · Fair queues
TideGuard
Open-source queueing for traffic surges: FIFO or lottery, signed admits, path protection, and a live control room. You deploy it; the origin only sees the rate you set.
The queue through the waiting room to your origin
TideGuard is a corridor, not a dashboard. Traffic enters, holds, and exits at the rate your origin can survive.
Join
Every visitor enters the same FIFO line. No VIP cuts, no randomized order. Durable Objects keep that order strongly consistent for one named queue.
Wait
Heartbeats keep the line honest. Silent clients drop out. ETA stays pluggable so you can show a calm estimate without flooding your origin.
Admit
Admission is a controlled rate. Signed HMAC tokens prove a visitor earned their turn, then expire so capacity cannot leak past your policy.
When the surge hits, the origin is not the queue
Ticket drops, flash sales, and product launches share one failure mode: more people arrive than the app can serve. Without a waiting room, retries pile on, caches miss, and the site that should open the door instead collapses under its own demand.
TideGuard sits in front of that moment. Visitors join a fair line—or an equal-odds lottery pool—on the edge. Your origin only receives the admit rate you set. Signed HMAC tokens prove someone earned their turn, then expire so capacity cannot leak past your policy. Heartbeats keep the line honest: silent clients drop out instead of holding a slot forever.
That is the whole job. Not a marketing overlay. Not a third-party black box with a seat-fee per visitor. An open-source waiting room you deploy, brand, and pace yourself—so engineering leads can show finance a cost estimate before Black Friday, not a surprise invoice after.
Fairness operators can defend
FIFO queue mode gives every visitor the same order: join, wait, admit. No VIP cuts unless you explicitly allowlist staff IPs or mint a Pass queue cookie for a smoke test. Lottery mode flips the model when equal odds matter more than position—each admit draws uniformly from the current pool, and the room shows odds instead of a hard line number. Switch live from the control room when the event shape changes.
Consistency matters under load. For a named queue, Durable Objects keep join order strongly consistent so two visitors who arrive a millisecond apart do not invent conflicting positions. Admission stays a controlled rate: you choose how many get through per window, and the waiting room absorbs the rest without hammering upstream health checks or login endpoints.
Control room for the launch window
Surges are operational, not only architectural. Operators need branding that matches the drop, live metrics while the line grows, and gates when traffic should not reach the origin at all. TideGuard’s admin control room covers wizard onboarding, live waiting-room preview, traffic pacing, queue depth, and a ~24h server-backed traffic chart—enough to run the room without bolting on a separate status dashboard.
Access gates travel with the same Worker. An IP allowlist lets fixed office ranges bypass without consuming admit capacity. Pass queue mints a browser cookie so QA can walk the path before the public does. Temporary country block uses CF-IPCountry with a TTL for event-window geo gates; allowlist and Pass queue still override, and hit counters surface in the live queue view so you can see whether the gate is doing real work.
Protect paths, keep cost visible
Origin proxy gates chosen paths at the edge. Unauthenticated traffic hits the waiting room; admitted traffic is proxied upstream with a token your app can trust. You do not need a session database on the origin just to remember who waited. Cookie, Bearer, or query delivery keeps integration flexible across storefronts, ticket flows, and API clients.
Because TideGuard is free open-source software, the bill you plan for is infrastructure you already understand: Workers requests and Durable Objects. Use the cost calculator to size a drop, read the full capabilities catalog for every control, browse surge plays for retail, tickets, and launches, or open the simulated demos—full page, embeddable widget, and custom API client—before you clone the GitHub repo and deploy.
Capabilities
Admission at the edge, a control room for the launch, and the knobs that set capacity and cost — without a managed waiting-room bill.
HMAC admission tokens
Signed, time-limited access
Admitted visitors carry a token (cookie, Bearer, or query). No session database on your origin.
Admin control room
Brand, pace, watch
Wizard onboarding, live branding preview, traffic controls, live queue metrics, and a ~24h server-backed traffic chart.
Origin proxy
Sit in front of the site
Gate paths at the edge. Unauthenticated traffic hits the waiting room; admitted traffic is proxied upstream.
IP allowlist + Pass queue
Staff skip the line
Fixed office IPs bypass without consuming capacity. Pass queue mints a cookie for this browser to smoke-test.
Temporary country block
Event-window geo gate
Block by CF-IPCountry with a TTL. Allowlist and Pass queue still override. Hit counters show in Live queue.
Full capabilitiesAdmission, control room, access gates, settings./demoFull page, widget, and API client (simulated)./costEstimate Cloudflare spend for your next drop.
Hold the line on Black Friday at a cost you can plan
Clone the repo, set your admit rate, and put a fair queue in front of the origin that cannot take everyone at once. Control room tools — allowlist, geo gate, analytics — ship in the same Worker.