A take-home deep dive into Cloudflare Application Services — two hostnames, one origin, and the architecture decisions that tie them together.
The Architecture at a Glance
Two hostnames, one origin — each transport chosen deliberately based on security posture and plan constraints.
app.berglabs.net
Proxied A record pointing to the origin IP. Edge validates a Let's Encrypt certificate at SSL mode Full (Strict). Hardened with a Cloudflare IP allowlist and Authenticated Origin Pulls (mTLS).
tunnel.berglabs.net
Proxied CNAME to a Cloudflare Tunnel. cloudflared dials outbound — no origin IP, no listener, no exposed attack surface whatsoever.
Why One Hostname Cannot Do Both
The DNS record type is what selects the edge-to-origin transport — and that choice has consequences.
The Plan Gate
Origin Rules DNS overrides that would allow a single hostname to switch transports are an Enterprise-only feature. On the free tier, the A record and the Tunnel CNAME must live on separate hostnames. This split is forced by a plan boundary — not a design preference.
The Constraint
A Record → IP Transport
Edge connects to origin IP; Full (Strict) applies.
CNAME → Tunnel Transport
Edge connects via cloudflared; origin IP never exposed.
The Identity Worker on tunnel.berglabs.net/secure
The binding to R2 is the authorization — no stored credentials, no scoped keys, no rotation schedule. The Worker inherits access through its runtime binding alone.
The Comparison Arm: Node Origin in Proxmox
The same handler logic runs on a Node.js origin inside a Proxmox container — revealing exactly what the edge binding eliminates.
Edge Worker
- JWT verified against team JWKS ✅
- Country read from
request.cf✅
- R2 flag fetch via runtime binding
- Zero stored credentials required
Node Origin
- JWT verification identical ✅
- Country detection identical ✅
- R2 flag fetch via S3 API credential
- Requires stored, scoped, rotated key
At the edge, the binding IS the authorization.
No credential to store. No rotation to schedule. No scope to misconfigure. The Worker's R2 binding carries implicit, scoped access — the operational burden simply disappears.
The Internal Tension: Full (Strict) vs. No-Bypass
Full (Strict) requires a reachable origin IP. A Tunnel-only posture exposes none. These two goals are in direct conflict — and the architecture must hold both simultaneously.
Coexistence Now
app.berglabs.net and tunnel.berglabs.net coexist today — each serving its role while demonstrating both transports.
Production Recommendation
Tunnel-only is the recommended production posture. Eliminating the origin IP from DNS entirely removes the most significant attack vector.
Hardening app.berglabs.net: Defense in Depth
SSL Full (Strict)
Edge validates the origin's Let's Encrypt certificate end-to-end — no opportunistic encryption, no self-signed bypass.
IP Allowlist
Origin firewall accepts connections only from Cloudflare's published IP ranges — direct connections are dropped at the network layer.
Authenticated Origin Pulls
mTLS ensures the origin only accepts requests carrying Cloudflare's client certificate — spoofed proxies are rejected cryptographically.
Verification Evidence
Every security claim is falsifiable — here is the evidence that each control actually works.
Direct-to-Origin Fails
Connections made directly to the origin IP without Cloudflare's mTLS client certificate are rejected — confirming the Authenticated Origin Pulls control is active.
Terraform Converges Clean
terraform plan reports zero changes — the declared infrastructure state matches the live Cloudflare configuration with no drift.
Worker in CI/CD
The Worker code lives in a public repository and is deployed automatically via CI — reviewable, reproducible, and auditable end-to-end.
Key Takeaways
Two hostnames, one forced by the plan gate
DNS record type selects transport; Origin Rules DNS override is Enterprise-only — the split is structural, not stylistic.
The Tunnel eliminates the most dangerous surface
No origin IP in DNS, no inbound listener — cloudflared's outbound dial is the production-grade posture.
The binding IS the authorization
R2 access at the edge requires zero stored credentials. The operational delta versus a Node origin is stark and measurable.
Securing and Serving at the Cloudflare Edge