The problem
Every request went straight to a load balancer in one US region. Nothing in front of it filtered traffic, and the origin answered anyone who found it. Users in Europe waited around 800 ms for a page that US users got in under 300 ms. Engineers reached private systems through a self-hosted VPN that carried a large backlog of compliance findings.
What Nuno did
Nuno moved the DNS zones into Terraform first, generating the records from the live zones instead of retyping them, and checking each one before the switch. The smallest, lowest-risk domain went first as a rehearsal, and it caught two real bugs before production was touched. Then Nuno put production behind the edge. The firewall rules were written from how the application actually behaves, not from a generic ruleset, and rate limits were sized to real endpoints. Only static assets and public pages are cached, never personalized HTML. Once all traffic flowed through the edge, Nuno locked every public load balancer so it only accepts edge traffic. In the last week of the month the VPN was replaced with identity-checked tunnels and per-team access rules, and the VPN servers were retired.
What went wrong
The cutover was not perfect. In the first hour a few rules blocked legitimate traffic, including a browser preflight request and an internal API call, and Nuno fixed each one within the hour. Nuno also found an old zone setting that required TLS 1.3, which silently rejected older clients once the edge started terminating TLS. Rehearsing on a small domain first is the reason these stayed small.
Results
Comparing the week before and the week after the cutover, average synthetic latency fell from 383 to 159 ms (59% lower), p95 from 438 to 196 ms and p99 from 476 to 242 ms. From Europe the average fell from 807 to 302 ms, and from US East from 274 to 139 ms. Cached public pages now serve in 85 to 106 ms, against about 686 ms from the origin. All production web traffic is inspected at the edge, the origin only accepts edge traffic, and the VPN with its findings backlog is gone. The edge costs about $2,640 a year, compared with about $3,000 a month for the managed AWS alternative.
Solutions
DNS and edge
- Three DNS zones moved into Terraform, generated from the live zones and checked record by record.
- Rehearsal on the lowest-risk domain before production.
- Production proxied through the edge, with caching limited to static assets and public pages.
Firewall and origin
- Firewall rules and rate limits built from the application's real endpoints.
- All public load balancers accept edge traffic only. Direct connections to the origin time out.
Private access
- Self-hosted VPN replaced by identity-checked tunnels with per-team access rules.
- Deployment tooling moved behind an identity login.
- VPN servers retired.
