Appendix A · Production Deployment Guide

This appendix covers deploying a CDN to public internet traffic. It is written for a principal engineer who has worked through the labs and is now hardening the system for production.

CDN Vendor Decision Matrix

For most organizations, building CDN infrastructure from scratch is not the right choice. Use a managed CDN vendor unless you have >1 Tbps of traffic and specific requirements that no vendor meets.

When to build your own CDN

Build only if all of these are true:

• Traffic > 1 Tbps sustained
• Specific protocol requirements (custom routing, custom protocols)
• Cost at scale exceeds vendor pricing significantly
• In-house expertise to operate CDN infrastructure 24/7

Companies that built their own: Netflix (Open Connect), Google, Meta, ByteDance/TikTok. Everyone else uses vendors.

Origin Protection

Your origin servers must not be directly reachable from the internet when you’re using a CDN. If they are, attackers can bypass the CDN:

Attacker discovers origin IP → sends traffic directly → DDoS bypasses CDN

Origin Protection Methods

1. Cloudflare-to-Origin mTLS (Authenticated Origin Pulls)

# nginx: only accept connections presenting Cloudflare's client certificate
ssl_verify_client on;
ssl_client_certificate /etc/nginx/cloudflare-origin-pull-ca.pem;

Cloudflare presents its certificate when connecting to your origin. Your origin rejects any connection without it.

2. IP allowlist at origin

Only allow traffic from CDN IP ranges:

# Cloudflare IPs: https://www.cloudflare.com/ips/
iptables -A INPUT -p tcp --dport 443 -s 103.21.244.0/22 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP

Cloudflare, Fastly, and AWS publish their IP ranges. Use the vendor’s API to pull the current list (IPs change).

3. Shared secret header

CDN adds a secret header; origin validates it:

CDN → Origin: X-CDN-Secret: <32-byte-random-secret>
Origin: reject any request missing this header

This is simpler but less secure than mTLS (header could leak in logs).

4. Private networking

Put origin on a private VPC; CDN connects via private peering:

• Cloudflare Magic WAN
• Fastly Secure Edge Connector
• AWS CloudFront + VPC Origins

WAF: Web Application Firewall

A WAF sits in front of your origin (at the CDN edge) and blocks malicious traffic before it reaches your application.

Common WAF Rule Sets

OWASP Core Rule Set (CRS): covers OWASP Top 10 attacks

• SQLi: GET /api/user?id=1 OR 1=1
• XSS: GET /search?q=<script>alert(1)</script>
• Path traversal: GET /files/../../../etc/passwd
• Remote file inclusion, SSRF

Bot management rules:

• Block known malicious user agents
• Challenge suspicious traffic (CAPTCHA)
• Rate-limit scraper patterns

Custom rules for your application:

• Block geographic regions not served
• Rate-limit unauthenticated API endpoints
• Block requests without required headers

Cloudflare WAF Setup

# Via Cloudflare API: enable OWASP Managed Rules
curl -X PUT "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/rulesets/phases/http_request_firewall_managed/entrypoint" \
  -H "Authorization: Bearer $CF_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "rules": [{
      "action": "managed_ruleset",
      "expression": "true",
      "action_parameters": {
        "id": "efb7b8c949ac4650a09736fc376e9aee"
      }
    }]
  }'

WAF False Positive Management

WAFs generate false positives. Common causes:

• API requests containing JSON with SQL-like syntax
• Developer tools testing edge cases
• Search queries containing special characters

Use audit mode first (log but don’t block), then move to block mode after reviewing false positives. Most vendors support per-rule enable/disable.

TLS Configuration

Certificate Provisioning

Cloudflare: Handles certificate provisioning automatically via Universal SSL or Advanced Certificate Manager. Zero configuration required.

Self-managed: Use ACME (Let’s Encrypt) with automatic renewal:

# certbot with nginx
certbot --nginx -d cdn.example.com --agree-tos --email ops@example.com

# Auto-renewal via cron
0 0,12 * * * certbot renew --quiet

TLS Minimum Version

Disable TLS 1.0 and 1.1 (deprecated; known attacks):

ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers off;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:...

TLS 1.3 should be preferred everywhere. TLS 1.2 minimum is the current industry standard (PCI DSS requires at least 1.2).

HSTS

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

Once HSTS is deployed and a client sees this header, the browser will refuse to make any HTTP request to this origin for 31,536,000 seconds (1 year). Submit to the HSTS preload list for even stronger enforcement.

Cost Optimization

CDN costs are typically:

• Bandwidth to end users: $0.01–0.08/GB depending on vendor and region
• Requests: $0.001–0.01 per 10,000 requests
• Origin egress: typically covered by CDN bandwidth; watch for AWS data transfer charges separately

Optimization Strategies

1. Maximize cache hit ratio

Every CDN hit replaces a CDN miss. CDN bandwidth is cheaper than:

• Origin bandwidth (higher utilization costs)
• Origin compute (request processing)
• Origin database queries

Target > 90% byte hit ratio. Each 1% improvement in hit ratio on 100 TB/day = 1 TB/day saved from origin, potentially saving thousands per month.

2. Compression

Compressing assets before caching multiplies your CDN capacity:

10 TB/day uncompressed HTML/CSS/JS
→ Brotli compression ~70% ratio
→ 3 TB/day stored and served
→ 70% bandwidth cost reduction

3. Choose regions wisely

Premium regions (Australia, South America, India) cost 2–5× more per GB than US/EU. If your user base is primarily US/EU, serving Asia from US CDN PoPs (higher latency but lower cost) may be acceptable for static assets.

4. Origin Shield

Origin shield (covered in Lab 13) reduces origin-bound requests. CDN vendors charge less for shield-to-origin bandwidth than edge-to-origin in some pricing models. More importantly, it reduces origin compute costs.

Deployment Checklist

Before going public with your CDN:

• Origin is not directly reachable from internet (IP allowlist or mTLS)
• WAF is enabled with OWASP CRS in audit mode → block mode after validation
• TLS 1.2+ minimum; TLS 1.3 preferred
• HSTS header set on all HTTPS responses
• Cache-Control headers set correctly on all content types
• Sensitive paths (admin, API tokens, auth callbacks) bypassed from CDN caching
• Purge API configured and tested
• Metrics and alerting configured (hit ratio, latency, error rate)
• SLOs defined and error budget dashboards live
• Load test with traffic 10× expected peak
• Incident runbook written and shared with on-call team