banatie-service/docs/url-fix-cloudflare-site.md

159 lines
3.8 KiB
Markdown

# CDN URL Architecture Fix - Cloudflare Configuration
This document describes the Cloudflare configuration for the new CDN URL architecture.
## Domain Structure
| Domain | Purpose | Cloudflare Proxy |
|--------|---------|------------------|
| cdn.banatie.app | CDN for images | Yes (orange cloud) |
| api.banatie.app | API server | Yes (orange cloud) |
| banatie.app | Landing page | Yes (orange cloud) |
## Cache Rules
### Rule 1: Cache UUID Images (High Priority)
Cache static images with UUID filenames for maximum performance.
**When:** Custom filter expression
```
(http.host eq "cdn.banatie.app" and http.request.uri.path matches "^/[^/]+/[^/]+/img/[0-9a-f-]{36}$")
```
**Then:**
- Cache eligibility: Eligible for cache
- Edge TTL: Override origin, 7 days
- Browser TTL: Override origin, 1 year (31536000 seconds)
- Cache Key: Include query string = No
### Rule 2: Bypass Cache for Aliases
Aliases need dynamic resolution, bypass cache.
**When:** Custom filter expression
```
(http.host eq "cdn.banatie.app" and http.request.uri.path matches "^/[^/]+/[^/]+/img/@")
```
**Then:**
- Cache eligibility: Bypass cache
### Rule 3: Bypass Cache for Live URLs
Live URLs need dynamic generation, bypass cache.
**When:** Custom filter expression
```
(http.host eq "cdn.banatie.app" and http.request.uri.path matches "^/[^/]+/[^/]+/live/")
```
**Then:**
- Cache eligibility: Bypass cache
## Page Rules (Alternative)
If not using Cache Rules, use Page Rules:
### Page Rule 1: Cache UUID Images
- URL: `cdn.banatie.app/*/img/*`
- Cache Level: Cache Everything
- Edge Cache TTL: 7 days
- Browser Cache TTL: 1 year
### Page Rule 2: Bypass Aliases and Live
- URL: `cdn.banatie.app/*/img/@*`
- Cache Level: Bypass
- URL: `cdn.banatie.app/*/live/*`
- Cache Level: Bypass
## DNS Configuration
Ensure DNS records point to your VPS:
```
cdn.banatie.app A YOUR_VPS_IP Proxied (orange cloud)
```
## SSL/TLS Configuration
- SSL Mode: Full (strict)
- Always Use HTTPS: On
- Automatic HTTPS Rewrites: On
- Minimum TLS Version: TLS 1.2
## Performance Settings
- Auto Minify: CSS, JavaScript (not HTML for API responses)
- Brotli: On
- Early Hints: On
- Rocket Loader: Off (may break API responses)
## Security Settings
- Security Level: Medium
- Challenge Passage: 30 minutes
- Browser Integrity Check: On
## Rate Limiting (Optional)
Create rate limiting rule for live URL abuse prevention:
**Rule Name:** Live URL Rate Limit
**When:**
```
(http.host eq "cdn.banatie.app" and http.request.uri.path matches "^/[^/]+/[^/]+/live/")
```
**Then:**
- Rate limit: 10 requests per minute per IP
- Action: Block for 1 minute
## Verification
After configuration:
1. **Test UUID caching:**
```bash
curl -I "https://cdn.banatie.app/org/proj/img/uuid-here"
# Check for: cf-cache-status: HIT (on second request)
```
2. **Test alias bypass:**
```bash
curl -I "https://cdn.banatie.app/org/proj/img/@alias"
# Check for: cf-cache-status: DYNAMIC or BYPASS
```
3. **Test live URL bypass:**
```bash
curl -I "https://cdn.banatie.app/org/proj/live/scope?prompt=test"
# Check for: cf-cache-status: DYNAMIC or BYPASS
```
## Troubleshooting
### Images not caching
- Verify the URL matches UUID pattern (36 character UUID)
- Check Cache Rules order (UUID rule should be first)
- Purge cache and retry
### Alias/Live URLs being cached
- Verify bypass rules are active
- Check rule order (bypass rules should run before catch-all)
- Development mode may disable caching
### Slow first requests
- Expected behavior for cache MISS
- Subsequent requests from same edge should be HIT
- Consider using Cache Reserve for longer edge retention
## Notes
- UUID pattern ensures only static, immutable images are cached at edge
- Aliases and live URLs are always fresh from origin
- 1-year browser cache is safe because UUID = immutable content
- Cloudflare caches at edge, browser caches locally