Skip to content

perf(sites): Cloudflare purge adapter and real-user Web Vitals (#74) - #145

Merged
clbotdev merged 2 commits into
mainfrom
perf/sites-hosted-cdn
Oct 25, 2026
Merged

clbotdev merged 2 commits into
mainfrom
perf/sites-hosted-cdn

Conversation

@clbotdev

Copy link
Copy Markdown
Contributor

Part of #75 and #74. Stacked on #144, which is stacked on #143. Retarget to main once those merge.

This covers the parts of #74 that don't need a vendor account. Choosing the vendor and where custom-domain TLS lives are your calls: a comparison and recommendation are in docs/site-delivery.md §7a. Nothing here is active until you configure it.

Changes

  • EDGE_PURGE_ADAPTER=cloudflare (CLOUDFLARE_ZONE_ID, CLOUDFLARE_API_TOKEN). Purges Cache-Tag tags in the zone that custom hostnames live in, in batches of 30, behind the Phase 3 interface and outbox (retries, 10 s repeat). FrontLit already emits Cache-Tag, so nothing else changes.
  • Real-user monitoring:
    • Public pages send one anonymous beacon per view (Core Web Vitals; no cookies, identifiers or URL) to POST /rum on the API. It has its own in-memory per-client limit and is disabled with SITE_RUM=off.
    • The API exports site_web_vital histograms by route kind and edge cache status, read from Server-Timing: edge from the Varnish recipe, which now adds it, or cfCacheStatus.
    • It also exports site_page_loads_total, for the hit ratio.
  • /metrics also reports site_cache_invalidations_pending and the oldest pending invalidation's age.
  • deploy/monitoring: a Grafana dashboard for the §9 targets (edge hit ratio > 95%, TTFB p75 on hits < 100 ms, LCP/INP/CLS p75 by route, pending invalidations), plus PromQL examples.
  • Docs: vendor comparison and recommendation (Cloudflare for SaaS), custom-domain TLS options (recommended: Cloudflare terminates TLS; apex proxying only when needed), and configuration.

Testing

  • API: 752 tests pass. New tests cover the Cloudflare batching, token and failure retry; RUM histograms, bounded labels and the rate limit.
  • End to end through the Varnish recipe in a real browser: visits to docs, blog, home and changelog produced site_web_vital series with cache="HIT" / "MISS", including INP from a click. /blog was correctly a MISS right after a purge.
  • Not tested against a real Cloudflare account; that needs the vendor decision and credentials.

- EDGE_PURGE_ADAPTER=cloudflare purges Cache-Tag tags in the zone that
  custom hostnames live in, in batches of 30, through the same outbox as
  the http adapter.
- Public pages send their Core Web Vitals in one anonymous beacon to the
  API's POST /rum (SITE_RUM=off disables it). The API exports them as
  Prometheus histograms by route kind and edge cache status, which is read
  from Server-Timing (the Varnish recipe now adds edge;desc=HIT|MISS).
  /metrics also reports pending cache invalidations.
- deploy/monitoring: a Grafana dashboard for the §9 targets: edge hit
  ratio, TTFB p75 on hits, LCP/INP/CLS p75 by route, pending
  invalidations.
- docs/site-delivery.md §7a: the vendors compared against the #74
  criteria, with a recommendation and the custom-domain TLS options.
@clbotdev
clbotdev force-pushed the perf/sites-edge-cache branch from a50b225 to 39893aa Compare October 25, 2026 08:15
@clbotdev
clbotdev force-pushed the perf/sites-hosted-cdn branch from 484d99d to 8948043 Compare October 25, 2026 08:15
@clbotdev
clbotdev changed the base branch from perf/sites-edge-cache to main October 25, 2026 09:09
@clbotdev
clbotdev merged commit db995df into main Oct 25, 2026
4 of 6 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants