Overview
A CDN keeps copies of what visitors ask for, so pages and files come back faster and your app or bucket does less work.
When to use it
- Images and videos from a bucket.
- Pages that rarely change.
- Taking load off an app.
How it works
- nginx 1.28
- One cache container per CDN behind the edge, its cache on a volume.
- HTTP caching
- Follows Cache-Control; never caches private or Set-Cookie responses; serves stale copies for up to a day when the origin fails.
The edge gives the CDN its hostname and certificate. Only GET and HEAD are cached; every response says HIT or MISS in X-Cache. Purge clears the cache.
Architecture
- Visitor to Edge
- Edge to nginx cache
- nginx cache to Bucket or app: on a miss
Flows
A first and a second visit
- The first request misses and is fetched from the origin, then stored.
- Later requests are served from the cache.
Set it up
In the console
- Open CDN and choose New CDN.
- Enter a hostname and choose the app or bucket.
- Choose Create.
With the CLI
enclave cdn create media --hostname media.localhost --origin bucket/uploads --waitWith OpenTofu
OpenTofu configuration
resource "enclave_cdn" "media" {
name = "media"
hostname = "media.localhost"
origin = "bucket/uploads"
}Settings reference
Every setting and output of the OpenTofu resource; the console and the CLI use the same names in their own words. Generated from platform 4d30582.
| Name | Type | Use | What it does |
|---|---|---|---|
hostname | text | required | Hostname to serve. Changing it replaces the CDN. |
name | text | required | Name of the CDN: 3–40 lowercase letters, digits or hyphens, starting with a letter. Changing it replaces the CDN. |
origin | text | required | app/<name> or bucket/<name>. |
default_ttl_seconds | number | optional | Cache time when the origin doesn't say, 0–31536000 (default 3600). |
max_size_mib | number | optional | Cache size in MiB, 64–102400 (default 1024). |
origin_port | number | optional | The app's port to fetch from (default the app's own). |
project | text | optional | The project to create it in. Defaults to the provider's project (ENCLAVE_PROJECT, else default). Changing it replaces the resource. |
tls | text | optional | auto, internal or off, as for domains (default auto; internal for .localhost). |
zone | text | optional | A DNS zone to get the certificate through (DNS-01). |
certificate_state | text | output | issued, pending or none. |
id | text | output | Resource ID. |
url | text | output | The CDN's URL. |
Limits and security
Good to know
- Purge after replacing a file with the same name.
Security
- Requests with Authorization are never cached.