# Put a service behind the right domain

Canonical page: https://yishto.com/en/learn/delivery/deployment-dns-gateways-and-cdn/

Author: [Yishto](https://yishto.com/en/about/)

Trace document-site delivery through domains, certificates, proxies, origins, and caches, including language variation, private responses, and the boundaries of hosting products.

Published: 2026-11-10
Updated: 2026-11-10

A document site is placing its preview service behind a public domain and serving lessons in Chinese and English. The browser must locate the service, validate the connection, and obtain the correct content version. Successful DNS resolution establishes only one part of that chain.

The case uses `/learn/` for public lessons and `/account/` for personal content. Lessons may use shared caching with language variation. Personal responses must stay outside it. These paths are a teaching contract, with no real accounts or live test results.

## Trace the request through each layer

A request can pass through DNS, TLS termination, a proxy or gateway, an application origin, and storage. A CDN may return content before contacting the origin. Each layer can fail independently, so record the hostname, protocol, path, status, deployment version, and request identifier during investigation.

The origin provides content, a reverse proxy forwards requests, a load balancer selects backends, and a gateway may enforce shared identity or traffic rules. Platforms sometimes combine these functions, but their responsibilities remain useful diagnostic boundaries. A proxy-generated 502 and an application-generated 404 require different investigations.

Define which routes serve static files, execute application logic, or read private objects. `/learn/` returns a course index; missing lessons return a real 404; account routes require authentication. Returning the homepage for every unknown path does not satisfy those contracts.

## DNS provides name resolution

A records map names to IPv4 addresses, AAAA records to IPv6 addresses, and CNAME records to other names. DNS does not encode a URL path or install a certificate. A machine receiving traffic still needs a listener, routing rules, and a certificate matching the hostname.

Resolvers and clients cache records according to their validity rules and TTL. An update is not a synchronized global event, and existing connections do not immediately switch because DNS changes. Lowering TTL ahead of a cutover can help, but records may remain cached under their earlier TTL and platform constraints still apply.

Distinguish the authoritative record, the result seen by a particular resolver, and the address a browser actually uses. A control-panel value does not establish the user's result. If IPv6 is enabled, verify the AAAA destination too, because different networks may otherwise reach different releases.

## Establish trusted TLS and proxy boundaries

TLS protects transport and authenticates connection endpoints through mechanisms including certificates. It does not establish that returned content is trustworthy or authorize business operations. Certificates must cover the hostname, with renewal and expiry monitoring included in ongoing delivery work.

If TLS terminates at a proxy, decide whether the origin connection is encrypted and how direct origin access is restricted. Clients can supply forwarded headers. An application should trust `X-Forwarded-For` or `X-Forwarded-Proto` only under explicit rules for trusted proxies that rewrite or validate them.

Coordinate proxy and backend timeouts. If a proxy times out before a long preview completes, a retry may duplicate work. A durable task ID with later status queries may suit the operation better. Load balancing also requires decisions about warmup, connection draining, and behavior when no backend is healthy.

## Cover response variation in cache keys

A cache reuses a response for matching requests. Before sharing it, determine whether content varies by user, language, permission, query parameters, or release. One key for Chinese and English can return the first stored language to both users. Sharing personal content can disclose data.

This example constructs keys for two languages and excludes private responses. Its private flag represents a trusted application decision; a real client must not control the privacy classification by supplying a boolean.

```python
def cache_key(path, language, private=False):
    if private:
        return None
    if language not in {"zh", "en"}:
        raise ValueError("unsupported language")
    return path + "|" + language
assert cache_key("/learn/", "zh") != cache_key("/learn/", "en")
assert cache_key("/account/", "zh", private=True) is None
print(cache_key("/learn/", "zh"))
```

The actual output is `/learn/|zh`. Assertions verify distinct language keys and `None` for personal content. An unsupported language raises `ValueError`. The function neither parses HTTP requests nor configures a CDN. Returning None does not itself prevent an external cache from storing a response.

Implementation also needs response cache policies and verification at the browser, proxy, and CDN. Content-fingerprinted static URLs can distinguish releases. A frequently updated index needs refresh behavior or a shorter lifetime. Keys that omit variation produce wrong responses; keys with excessive variation reduce reuse and increase storage.

## Match hosting choices to product boundaries

A VPS provides runtime control while leaving patching, process management, backups, and ingress maintenance to the operator. Static hosting serves built pages, while dynamic authentication and background work require additional execution capabilities. Managed platforms still need checks on builds, runtimes, permissions, regions, quotas, and recovery.

Cloudflare Workers static assets can be combined with Worker routing and asset bindings. R2 is object storage, not an application runtime. Public objects, private reads, and domain access need their own configuration. List the required logic before deciding whether a product supports it.

The available ModelScope Studio repository documents a Gradio component library. It does not establish production hosting or an SLA for arbitrary static sites. Considering a related hosting service requires current platform documentation and account eligibility. Without that evidence, limit the conclusion to documented component capabilities.

Keep the previous artifact and routing configuration in the cutover plan, and describe recovery at each layer. An origin rollback may leave newer CDN content in place; clearing a cache cannot fix a broken origin. Request the important pages again and verify content and status before declaring recovery complete.

## Exercise: verify a version cutover

Build a verification table for HTTP to HTTPS, primary and alternate domains, both languages, missing routes, personal pages, and static assets. Check redirect status and Location. For non-GET methods, select semantics that match the contract rather than assuming every client preserves the method on a 301.

Accept the configuration when languages cannot share incorrect cached content, personal responses are not reused publicly, missing routes have correct statuses, certificates match hostnames, and pages and files identify the deployed version. Simulate old DNS, stale cache, and an unavailable backend. Record the layer that exposes each failure and the recovery action. A real release requires external request verification; the offline function proves only its local key rules.

## Sources & further reading

- [Domain names and DNS](https://developer.mozilla.org/en-US/docs/Learn_web_development/Howto/Web_mechanics/What_is_a_domain_name)
- [TLS 1.3 — RFC 8446](https://www.rfc-editor.org/rfc/rfc8446.html)
- [NGINX beginner's guide](https://nginx.org/en/docs/beginners_guide.html)
- [Workers static assets — Configuration and bindings](https://developers.cloudflare.com/workers/static-assets/binding/)
- [Object storage concepts](https://developers.cloudflare.com/r2/)
- [ModelScope Studio components and official examples](https://github.com/modelscope/modelscope-studio)

Sources checked on 2026-11-10. Examples are teaching data, not production measurements.

## Related guides

- [Trace the boundaries between a URL and a page](https://yishto.com/en/learn/computing/web-request-journey/)
- [Balance localization, SEO, and loading behavior](https://yishto.com/en/learn/web-interface/localization-and-web-performance/)