Reverse proxy plan for phase one

01How it works

• Cloudflare goes in front of www.fairway.com, in Fairway's own Cloudflare account. DNS stays in Azure; only the www record changes.
• A Cloudflare Worker sends the phase one pages to the new Webflow site, and every other page to the current one. The Candid Leap team keeps the list of phase one pages.
• Visitors only ever see www.fairway.com.
• It's temporary: once the new site has everything, www.fairway.com and fairway.com move to it, and we remove Cloudflare.

02The switch, in one record

Today, Azure DNS has one record for www.fairway.com: a CNAME pointing at cdn.webflow.com. That's how visitors reach the current Webflow site.

• Today: www.fairway.com → Azure says cdn.webflow.com → the current Webflow site.
• After the switch: www.fairway.com → Azure says www.fairway.com.cdn.cloudflare.net → Cloudflare → the Worker sends each page to the current site or the new one.

"Switching to Cloudflare" means only that: changing the value of that one record in Azure. staging.fairway.com gets the same change first, as a test.

03Adding fairway.com to Cloudflare without moving DNS

Fairway's nameservers stay in Azure the whole time. Cloudflare's partial (CNAME) setup is made for this, and it's only offered on the Business or Enterprise plan.

1. In Fairway's Cloudflare account, add fairway.com and pick the Business plan.
2. Skip Cloudflare's instructions to change nameservers.
3. On the domain's Overview page in Cloudflare, choose "Convert to CNAME DNS Setup". Cloudflare then shows a verification TXT record, cloudflare-verify.fairway.com.
4. Add that TXT record in Azure DNS, and keep it for as long as the setup exists.

From then on, a hostname goes through Cloudflare only when its CNAME in Azure points at <hostname>.cdn.cloudflare.net. Everything else in Azure, including mail and the bare domain, works exactly as today. The Terraform scripts can create the zone as a CNAME setup directly.

04Domains

05How staging behaves

Webflow sends every extra domain on a site to its main domain, which is www. So:

• Before the Worker is on: staging.fairway.com redirects to www.fairway.com. This is expected.
• With the Worker on: staging stays on staging. The Worker fetches current-site pages from www.fairway.com and new pages from webflow1.fairway.com, so Webflow never sees a request for staging.
• With the Worker off again: staging redirects to www again.
• Links inside pages that are written as full www addresses lead to www. During testing, the Worker rewrites them to staging.

www.fairway.com never redirects, because it's the main domain. fairway.com keeps redirecting to www.

06Milestones

Staging goes through the exact steps www goes through later, so every step is tried once before it touches the live site. Each milestone starts only when the one before it works. Before each one, we take the backups listed under "Backups before every change".

07Backups before every change

Before each milestone, we save the current state, so anything can go back exactly as it was.

• Azure DNS: the Fairway team exports the whole fairway.com zone to a file before milestone 1 and before each record change: az network dns zone export -g <resource group> -n fairway.com -f fairway.com.txt. That file is the reference copy. Going back means setting each changed record to its old value, which the Terraform scripts can do.
• Webflow: a named backup of the current site before staging.fairway.com is added and published, and of the new site before launch (Site settings → Backups). On a paid plan, Webflow can restore any backup.
• Cloudflare: every Worker version is kept, so the previous one can be restored in seconds. The zone and its records live in the Terraform scripts.
• Change log: every change written down with its old value, new value, time and who made it.

08What changes

Azure DNS Fairway team

fairway.com (the bare domain) keeps its A record pointing at Webflow. A partial Cloudflare setup can't take the bare domain, and it doesn't need to: Webflow redirects it to www, which then goes through Cloudflare.

Webflow Fairway team

• Current site: add staging.fairway.com as one more domain and publish. www.fairway.com stays its main domain, and fairway.com stays on it. Remove staging after launch.
• New site: a paid plan, with webflow1.fairway.com as its domain.

09How we set it up: Terraform

• The Candid Leap team writes Terraform scripts for the whole setup: the Azure DNS records, and the Cloudflare zone, records, Worker and routes.
• The Candid Leap team most likely won't have full access to your Azure and Cloudflare dashboards, so the Fairway team runs the scripts. If needed, we help set up the Terraform configuration for both Azure and Cloudflare.
• The same scripts cover later changes too, such as the www record change or a rollback.
• We prepare everything else as well, including the repository with the Worker and the scripts.

10SSL

• Visitors get Cloudflare's free certificate. It renews itself.
• Behind Cloudflare, Webflow keeps its own certificates, as today.
• Webflow only supports Cloudflare in front of a site that uses its new DNS records. The current site already does: cdn.webflow.com for www and 198.202.211.1 for the bare domain (checked on 1 October).
• Cloudflare's SSL settings must follow Webflow's guide (linked under Docs). A wrong setting shows a 525 SSL error, which we'd hit on staging first, never on www.

11Security headers

The current site sends these two headers on every page (checked on 1 October, including the homepage, a state page, a product page and a 404):

• Content-Security-Policy: frame-ancestors 'self'
• X-Frame-Options: SAMEORIGIN

Both stop other websites from showing fairway.com pages inside a frame.

• The new site must send the same two headers.
• The Worker passes each site's headers through unchanged. It does not add, remove or rewrite them.

12Checklist (staging first, then www)

• Phase one pages come from the new site, everything else from the current one.
• Loan officer pages, forms, redirects and Webflow Optimize (A/B tests) all work, and fairway.com still redirects to www.fairway.com.
• Every page, from either site, sends the two security headers above.
• Changing the staging.fairway.com record back to cdn.webflow.com works, and we time it.

13If something goes wrong

1. Turn off the Worker on www.fairway.com: back to the current site in seconds.
2. If needed, change the www.fairway.com record in Azure back to cdn.webflow.com: about 5 minutes.

14What we need from the Fairway team

• The Cloudflare Business plan on fairway.com.
• The Azure records at each milestone, applied from our Terraform scripts.
• A Cloudflare API token limited to the Worker and its routes on fairway.com, so the Candid Leap team can deploy the Worker and turn it on or off, including the quick undo. If that's not possible, the Fairway team runs those steps from our scripts.
• staging.fairway.com added to the current Webflow site, and a paid Webflow plan for the new site.
• Where the repository with the Worker and the Terraform scripts lives, and who runs it.
• Someone on hand for milestone 3 and launch day.

15Cost

• Cloudflare Business plan: $250 a month. Subdomains are included.
• Optional: Workers Paid, $5 a month, for more than 100,000 requests a day.

16Docs

Cloudflare

• Partial (CNAME) setup: what it is, and Business plan required
• Partial setup: step by step, including the verification TXT record
• Free certificates on a partial setup cover every subdomain
• Certificate validation with TXT records
• Certificate renewal, and keeping the Worker off validation paths
• Worker routes
• Worker limits (the 100,000 requests a day free tier)
• Roll back a Worker to a previous version

Webflow

• Using Cloudflare Orange-to-Orange (O2O) with Webflow
• Set up a self-managed reverse proxy in Webflow
• Manually connect a custom subdomain
• Default domain: other domains redirect to it
• Save and restore backups

Azure

• Manage DNS records in the Azure portal
• Export and import a DNS zone file

Terraform

• Cloudflare provider: zone (set it as a partial setup)
• Azure provider: DNS CNAME record