Skip to content
NutsNews chestnut logoNutsNews Wiki

Technical guide · Core platform

Page status: Active

NutsNews Backend Cloudflare Routing

This documents the backend routing model for backend.nutsnews.com.

Visual overview

Primary diagram

System map

This documents the backend routing model for backend.nutsnews.com.

Render the repository-owned system map when you need it.

Diagram is not rendered yet.

View as text
NutsNews Backend Cloudflare Routing

This documents the backend routing model for backend.nutsnews.com.

flowchart TD
  accTitle: NutsNews Backend Cloudflare Routing
  accDescr {
    This documents the backend routing model for backend.nutsnews.com.
  }
  D[DNS request for backend.nutsnews.com] --> R[Cloudflare DNS-only A record]
  R --> F[Cloudflare routing policy to backend infrastructure]
  F --> V[Vercel route handling and environment boundaries]
  V -->|api route| A[backend API services]
  V -->|other routes| S[VPS/secondary routing services]
  S --> T[Cloudflare Tunnel when required]
  F --> M[Failure or maintenance fallback paths]

NutsNews Backend Cloudflare Routing

Fullscreen diagram view.

NutsNews Backend Cloudflare Routing

Section titled “NutsNews Backend Cloudflare Routing”

This documents the backend routing model for backend.nutsnews.com.

Summary

Section titled “Summary”

The backend uses Cloudflare-managed DNS with a DNS-only A record:

NameTypeTargetProxied
backend.nutsnews.comA65.75.201.18false

DNS-only is the reviewed first phase. It keeps SSH separate from Cloudflare HTTP proxying, lets Caddy manage a public origin certificate, and avoids enabling Cloudflare edge proxy behavior before backend app routes and edge policy are designed.

Origin Health

Section titled “Origin Health”

The backend protected apply installs Caddy and serves:

/healthz -> ok

All other public paths return 404 until a reviewed backend app deployment owns them.

Apply Path

Section titled “Apply Path”

Backend repo workflows:

  • Protected Backend Ansible Apply installs Caddy, opens reviewed HTTP/HTTPS ports, and verifies direct-origin health.
  • Backend Cloudflare Routing checks, applies, or rolls back the Cloudflare DNS record through the protected production-backend Environment.

DNS apply mode verifies the origin first with:

Terminal window
curl --resolve backend.nutsnews.com:80:65.75.201.18 http://backend.nutsnews.com/healthz

Verification

Section titled “Verification”
Terminal window
dig +short backend.nutsnews.com A
curl -fsS https://backend.nutsnews.com/healthz
curl -Iv https://backend.nutsnews.com/healthz

Expected health response:

ok

Rollback

Section titled “Rollback”

Run Backend Cloudflare Routing with run_mode=rollback and confirm_apply=backend.nutsnews.com. If the origin listener also needs removal, revert the backend routing PR and run the protected backend Ansible check/apply path.