Cloudflare
Cloudflare sits in front of the origin. DNS, certificates, caching, and an initial filter for abusive traffic are handled there, so AWS can focus on running the application. Public forms on this site also use Turnstile, Cloudflare’s challenge, and a submission is accepted only after that check succeeds.
It is part of the delivery infrastructure. It is not a product we resell, and it does not replace authentication and validation inside Laravel.
Start a conversation about a platform that needs this edge, or read Project initiation.
At a glance
| Kind | Edge network |
| Fits | DNS, TLS, caching, challenges on public forms |
| Origin behind it | AWS, for the application and the database |
| Does not replace | Application authentication, validation, or backups |
When we use it
- Providing a certificate and a hostname for a Nuxt application or a Laravel API, without running that service on the origin
- Caching assets and anonymous pages that are safe to cache, so the origin is not requested for every visit
- Challenging public forms, so scripted submissions are rejected before they reach application code
- Keeping DNS with the rest of the edge configuration
Authenticated API traffic is a poor candidate for caching. Caching is not enabled for a whole portal, because private pages must not be stored and served to other visitors.
What we rely on
- DNS and TLS for the hostnames the product uses
- Cache rules that match the routes: static assets and selected public pages, not responses that belong to a session
- Turnstile on public forms, verified on the server. A widget that the API does not verify does not provide protection
- A clearly defined origin. The edge forwards to AWS. It is not a second, partial copy of the application configuration
Why it fits the work
- Faster repeat visits for public content. Assets and cacheable pages are served from the edge. The API does less of that work, so it remains available for application requests.
- The origin can be changed without a client release. Hostnames point at Cloudflare. Changing what sits behind a name is a configuration change.
- Less unsolicited traffic reaches the application. Challenges and basic filtering handle routine abuse. Account security, authorisation, and input validation still happen in Laravel, where the rules are defined.
- Certificates without a dedicated server. Certificates and the edge are provided as a service. That is simpler than maintaining a server whose only role is TLS.
How we build with it
The engagement follows Project initiation. The edge is part of the architecture, because caching and hostnames are difficult to correct late.
- Architecture. Which hostnames exist, which routes may be cached, and where the origin is. Public and authenticated traffic are specified separately.
- Development. Each environment has its own hostnames. A cache rule is tested against an authenticated response before it is trusted.
- Hardening. TLS, restricted origin access where the platform allows it, and Turnstile verified on the server. Secrets for those checks are not kept in the frontend repository history.
- Release and support. Cache and DNS changes are made deliberately. After launch, a new public route includes a decision about whether it may be cached.
How it sits in the stack
Cloudflare is in front of AWS. It forwards to Nuxt and Laravel. Flutter applications call the API through that hostname. MySQL is not exposed to the edge.
Tailwind CSS reaches Cloudflare only as built files in the asset cache.
In practice
This site is served through Cloudflare, and its contact form is not accepted until Turnstile has been completed and verified. Client platforms use the same division: the edge provides DNS, TLS, caching, and challenges, and the application on AWS handles the business process.
Questions
Is Cloudflare enough security for a portal?
No. It protects the network edge. Sign-in, permissions, and validation belong in the application. An edge rule that blocks some traffic does not make an unprotected administration route acceptable.
Do you put Cloudflare in front of AWS and another CDN as well?
Not by default. Two caches in sequence are two places where a stale or private response can be stored. AWS runs the origin. Cloudflare is the edge.
Can you work with a domain we already control?
Yes. Existing DNS is a constraint we need at the start, together with the name of whoever is permitted to change it. Moving a hostname is a planned step. It is not carried out as part of an application deployment.
Next step
When a platform is being scoped, the edge should be discussed with the hosting, rather than after a production problem. Start a conversation.
Related: Amazon Web Services, Nuxt, Laravel, Technology.