Skip to content

ADR-0002: Cloudflare for Hosting and Edge Compute

Status: Accepted Date: 2025-01-15 (Estimated) Deciders: GetCimple Team Tags: infrastructure, hosting, deployment, cdn

Context

GetCimple needs hosting infrastructure for multiple properties: - Main SPA application (React) - Marketing website - Documentation sites (internal + customer via MkDocs) - Edge functions for serverless compute - File storage (compliance evidence, reports)

Requirements: - Global CDN for fast page loads (Australian users priority) - Simple deployment (CI/CD via GitHub Actions) - Static site hosting (MkDocs, marketing) - Serverless functions for API logic - SSL/TLS by default - DDoS protection - Startup-friendly pricing

Constraints: - 3-person team (minimal DevOps capacity) - Must integrate with Supabase backend - Fast deployment cycles for MVP iteration - Budget: <$100/month for MVP hosting

Options Considered

Option A: Cloudflare Pages + Workers

Description: Static site hosting on Cloudflare Pages with Cloudflare Workers for edge compute.

Pros: - ✅ Pages: Unlimited static sites, automatic deployments from GitHub - ✅ Workers: Serverless edge compute, 100ms response times globally - ✅ Global CDN: 300+ edge locations, fast for Australian users - ✅ Free tier: Generous limits (500 builds/month, 100k Worker requests/day) - ✅ DDoS protection: Enterprise-grade, included free - ✅ SSL/TLS: Automatic certificates - ✅ R2 Storage: S3-compatible object storage, zero egress fees - ✅ Simple deployment: GitHub integration, preview deployments - ✅ Edge compute: Workers run close to users (low latency) - ✅ Zero config: DNS, CDN, SSL all managed - ✅ Excellent DX: Wrangler CLI, good documentation

Cons: - ❌ Workers have execution limits (50ms CPU time per request on free tier) - ❌ Cold starts for infrequently-used Workers - ❌ Learning curve for Workers API (different from traditional Node.js) - ❌ Vendor lock-in to Cloudflare platform

Estimated Effort: 1-2 days setup

Option B: Vercel

Description: Frontend hosting platform with serverless functions.

Pros: - ✅ Excellent Next.js/React support - ✅ Automatic deployments from GitHub - ✅ Global CDN - ✅ Serverless functions (Node.js) - ✅ Great DX and documentation

Cons: - ❌ More expensive at scale ($20/user/month for team features) - ❌ Bandwidth limits on free tier (100GB/month) - ❌ Function execution limits (10 second timeout, 50MB output) - ❌ No Australian-specific edge locations (routing via Singapore) - ❌ No object storage (need separate S3 or similar)

Estimated Effort: 1-2 days setup

Option C: AWS (S3 + CloudFront + Lambda)

Description: Self-managed hosting on AWS with CloudFront CDN and Lambda functions.

Pros: - ✅ Full AWS ecosystem integration - ✅ Sydney region available (ap-southeast-4) - ✅ Extremely scalable - ✅ Comprehensive services

Cons: - ❌ Complex setup (S3 buckets, CloudFront distributions, Lambda functions, API Gateway) - ❌ Significant DevOps overhead for 3-person team - ❌ Steep learning curve - ❌ More expensive for low traffic (no generous free tier) - ❌ 1-2 weeks setup time - ❌ Ongoing management burden

Estimated Effort: 1-2 weeks initial setup + ongoing management

Decision

We chose: Option A - Cloudflare Pages + Workers + R2

Rationale: 1. Simplicity: Zero-config deployment, automatic SSL, integrated CDN—perfect for 3-person team 2. Cost-effective: Free tier supports MVP, predictable pricing at scale 3. Australian performance: Global CDN with Australian PoPs provides fast access for target market 4. Complete platform: Pages (static), Workers (compute), R2 (storage) covers all needs 5. Fast deployment: GitHub integration with automatic preview deployments accelerates iteration 6. DDoS protection: Enterprise-grade security included, critical for compliance platform 7. Developer experience: Excellent tooling (Wrangler CLI) and documentation

Key Trade-offs Accepted: - We're accepting Workers execution limits (50ms CPU) by keeping compute lightweight - We're accepting platform lock-in for deployment velocity (can migrate static sites easily, Workers would need rewrite) - We're deferring Workers optimization to post-MVP (start simple, optimize if needed)

Consequences

Positive

  • ✅ Zero DevOps burden: No servers to manage, automatic scaling, built-in monitoring
  • ✅ Fast deployments: Push to GitHub → deployed globally in <2 minutes
  • ✅ Global performance: <100ms response times for Australian users
  • ✅ Multiple properties: Marketing, docs, app all on same platform (simplified management)
  • ✅ Preview deployments: Every PR gets preview URL for testing
  • ✅ Cost predictable: Free tier → $20-50/month for MVP → scales linearly
  • ✅ Security included: DDoS protection, WAF, SSL/TLS, bot management

Negative

  • ⚠️ Workers learning curve: Different from traditional Node.js (V8 isolates, no Node APIs)
  • ⚠️ Execution limits: 50ms CPU time requires efficient code
  • ⚠️ Platform lock-in: Workers code not portable to other platforms without rewrite
  • ⚠️ Cold starts: Infrequently-used Workers may have 10-50ms cold start

Risks

Risk Likelihood Impact Mitigation
Workers CPU limits hit for complex operations MEDIUM MEDIUM Offload heavy compute to Supabase functions; optimize hot paths; upgrade to paid Workers if needed
Cloudflare outage affects all properties LOW HIGH Monitor Cloudflare status; acceptable downtime for MVP; consider multi-CDN post-MVP
R2 costs grow unexpectedly LOW MEDIUM Monitor storage usage; implement file lifecycle policies; compress evidence files

Compliance Note

ACSC Essential 8 Impact: - Relevant Controls: Not directly applicable (hosting is infrastructure) - Data Residency: Cloudflare Workers can be restricted to specific regions; R2 storage configured for Australia

Australian Data Residency: - Static Assets: Served globally via CDN (acceptable - no sensitive data) - Edge Compute: Workers execute in nearest datacenter (can be restricted if needed) - Object Storage: R2 buckets configured for Sydney region for sensitive files - Guarantees: Cloudflare complies with Privacy Shield framework

Audit Trail: - Cloudflare logs all deployments via GitHub Actions - Worker logs track execution and errors

Implementation Notes

Prerequisites: - Cloudflare account created - Domains configured (getcimple.com, app.getcimple.com, docs.getcimple.com, internal.docs.getcimple.io) - GitHub Actions configured with Cloudflare API tokens

Integration Points: - GitHub: Automatic deployments on push - Supabase: Workers call Supabase APIs for data - Kinde: OAuth redirect URLs configured for Cloudflare domains - MkDocs: Build output deployed to Pages

Monitoring: - Cloudflare Analytics dashboard for traffic and performance - Worker logs for errors and exceptions - GitHub Actions for deployment status

Documentation Updates Needed: - ✅ Deployment process in deployment-mvp.md - ✅ Worker configuration in tech-stack-mvp.md - ✅ Infrastructure overview in simplified-mvp-architecture.md

Revisit

Revisit By: 2026-01-01 or after 1000 active users Blast Radius: HIGH - Affects all hosting infrastructure (app, docs, marketing)

Conditions for Revisit: - Cloudflare bandwidth costs exceed $200/month - Workers CPU limits become blocking issue (>10 incidents/month) - Need for features Cloudflare doesn't provide (specific compliance, advanced compute) - Multi-region requirements (e.g., expanding beyond Australia)

Next Review: 2025-07-01

References

Version History

Version Date Author Changes
1.0 2025-10-20 Claude Initial ADR capturing historical decision