Cloud Hosting Expert

---
name: cloud-hosting-expert
description: "Multi-tenant SaaS deployment on modern edge (Vercel, Cloudflare) / Deployment SaaS multi-tenant di edge modern (Vercel, Cloudflare)."
author: "Roedy Rustam"
version: "4.8.0"

---

# Cloud Hosting Expert (2026 Edition)

[English](#english) | [Bahasa Indonesia](#bahasa-indonesia)

---

<a name="english"></a>
## English

### Orchestration & Integration
- **Upstream & Orchestration**: `zero-to-prod-orchestrator` (Phase 7 deployment), `brainstorming`, `session-memory-manager`.
- **CI/CD & Container Pipelines**: `ci-cd-devops-architect` (deployment automation), `github-actions-expert` (cloud actions & OIDC), `docker-container-expert` (container images for Railway/Fly).
- **Edge Compute & Serverless**: `cloudflare-workers-expert` (Cloudflare Workers, D1, KV, R2), `api-gateway-proxy-expert` (edge routing & proxies).
- **Monitoring & Auto-Remediation**: `proactive-background-watcher` (deployment health checks), `self-healing-cloud-orchestrator` (production crash hotfixing).
- **Cross-Domain Synergy & Subagent Swarm Integration**: `kubernetes-gitops-platform-expert`

### Description
Expert guide for deploying SaaS applications and their multiple entry points (landing page, app, super admin subdomain) on modern edge and serverless platforms. Covers Vercel, Cloudflare Workers & Pages, Railway, Fly.io, and **Cloudflare Workers AI** for AI-powered edge workloads.

### Trigger Conditions
- Deploying a Next.js, Hono, or Astro application to Vercel, Cloudflare, or Railway.
- Configuring custom domains and subdomain routing (e.g., `app.domain.com`, `admin.domain.com`).
- Setting up Edge Middleware for multi-tenant tenant identification.
- Deploying AI inference workloads to **Cloudflare Workers AI**.
- Deploying long-running backend services to **Railway** or **Fly.io**.
- Implementing CDN caching strategies for SaaS applications.

### Platform Selection Guide (2026)

| Platform | Best For | Free Tier | Cold Start |
|---|---|---|---|
| **Vercel** | Next.js, static, serverless functions | ✅ | ~200ms |
| **Cloudflare Workers** | Ultra-low latency APIs, edge logic | ✅ (100k req/day) | ~0ms |
| **Cloudflare Pages** | Static + full-stack (via Workers) | ✅ | ~0ms |
| **Railway** | Node.js/Go/Python long-running services, Bun | ✅ (5$/mo credit) | None |
| **Fly.io** | Docker containers, global distribution | ✅ (3 shared VMs) | ~500ms |
| **Render** | Node.js/Go/Python persistent services | ✅ (spins down) | ~30s |

### Multi-Entry Point Deployment Architecture

For SaaS applications, separate deployments for each entry point:
```
myapp.com         → Vercel (Marketing/Landing — Next.js static)
app.myapp.com     → Vercel (SaaS App — Next.js dynamic)
admin.myapp.com   → Vercel (Super Admin — Next.js, restricted access)
api.myapp.com     → Railway/Fly.io (Backend API — long-running)
cdn.myapp.com     → Cloudflare R2 (Static assets & user uploads)
```

### Vercel — Next.js Deployment

#### Multi-Domain Configuration
```json
// vercel.json
{
  "rewrites": [
    { "source": "/(.*)", "destination": "/$1" }
  ],
  "headers": [
    {
      "source": "/(.*)",
      "headers": [
        { "key": "X-Content-Type-Options", "value": "nosniff" },
        { "key": "X-Frame-Options", "value": "DENY" },
        { "key": "Strict-Transport-Security", "value": "max-age=63072000; includeSubDomains; preload" }
      ]
    }
  ]
}
```

#### Edge Middleware for Tenant Routing
```typescript
// middleware.ts — runs at the edge before every request
import { NextResponse } from 'next/server';
import type { NextRequest } from 'next/server';

export function middleware(request: NextRequest) {
  const hostname = request.headers.get('host') ?? '';
  const subdomain = hostname.split('.')[0];

  // Route admin subdomain — enforce strict auth check
  if (subdomain === 'admin') {
    const adminToken = request.cookies.get('admin-session')?.value;
    if (!adminToken) {
      return NextResponse.redirect(new URL('/login', request.url));
    }
  }

  // Identify tenant from subdomain for multi-tenant apps
  if (subdomain !== 'www' && subdomain !== 'app' && subdomain !== 'admin') {
    const response = NextResponse.next();
    response.headers.set('x-tenant-slug', subdomain);
    return response;
  }

  return NextResponse.next();
}

export const config = {
  matcher: ['/((?!_next/static|_next/image|favicon.ico).*)'],
};
```

### Cloudflare Workers — Edge APIs

#### Hono on Cloudflare Workers
```typescript
// src/index.ts
import { Hono } from 'hono';
import { cors } from 'hono/cors';
import { rateLimit } from '@/middleware/rateLimit';

const app = new Hono<{ Bindings: Env }>();

app.use('*', cors({ origin: ['https://app.myapp.com'] }));
app.use('/api/*', rateLimit(100)); // 100 req/min via KV

app.get('/api/health', (c) => c.json({ status: 'ok', region: c.env.CF_REGION }));

app.get('/api/data', async (c) => {
  // Access Cloudflare D1 (SQLite at edge)
  const result = await c.env.DB.prepare('SELECT * FROM items LIMIT 20').all();
  return c.json(result.results);
});

export default app;
```

#### Cloudflare Workers AI (On-Device Edge Inference)
Run AI models directly at Cloudflare's edge — no external API calls needed:
```typescript
export default {
  async fetch(request: Request, env: Env) {
    const { text } = await request.json() as { text: string };

    // Run Llama 3 or Mistral at the edge
    const response = await env.AI.run('@cf/meta/llama-3.1-8b-instruct', {
      messages: [
        { role: 'system', content: 'You are a helpful assistant.' },
        { role: 'user', content: text }
      ],
      stream: true,
    });

    return new Response(response, {
      headers: { 'Content-Type': 'text/event-stream' }
    });
  }
};
```

Available models on Workers AI:
- `@cf/meta/llama-3.1-8b-instruct` — Fast general-purpose chat
- `@cf/mistral/mistral-7b-instruct-v0.2` — Fast instruction model
- `@cf/baai/bge-small-en-v1.5` — Text embedding (for RAG)
- `@cf/stabilityai/stable-diffusion-xl-base-1.0` — Image generation

### Railway — Bun / Node.js Long-Running Services
```dockerfile
# Dockerfile for Railway (Bun runtime)
FROM oven/bun:1.2-alpine
WORKDIR /app
COPY package.json bun.lockb ./
RUN bun install --frozen-lockfile
COPY . .
EXPOSE 3000
CMD ["bun", "run", "src/server.ts"]
```

```toml
# railway.toml
[build]
builder = "DOCKERFILE"

[deploy]
startCommand = "bun run src/server.ts"
healthcheckPath = "/health"
healthcheckTimeout = 10
restartPolicyType = "ON_FAILURE"
```

### Environment Variables & Secrets Management
- **Vercel**: Use Vercel's built-in secrets panel — supports preview/production scoping.
- **Cloudflare**: Use `wrangler secret put SECRET_NAME` or the dashboard.
- **Railway**: Use Railway's variable groups for shared secrets across services.
- **Never** commit `.env` files — use `.env.example` as documentation only.

### Caching Strategy
```typescript
// Vercel: Cache API responses at the edge
export async function GET() {
  const data = await fetchData();
  return Response.json(data, {
    headers: {
      'Cache-Control': 'public, s-maxage=60, stale-while-revalidate=300',
    }
  });
}

// Cloudflare: Use Cache API
const cache = caches.default;
const cached = await cache.match(request);
if (cached) return cached;
```

### Hard Guardrails (Declarative Invariants)
1. **Edge Deployment Ephemeral State Invariant**:
   - Edge runtimes (Vercel Edge, Cloudflare Workers) MUST NOT rely on local disk storage or long-lived in-process memory. State MUST be persisted in distributed stores (Cloudflare D1/KV, Supabase, Upstash Redis).
2. **Explicit Cache-Control Headers on Static & SWR Responses**:
   - All serverless and edge GET endpoints MUST return explicit `Cache-Control` headers (e.g. `public, s-maxage=..., stale-while-revalidate=...`). Never rely on default unconfigured edge cache behaviors.
3. **Dedicated Subdomain Routing Isolation**:
   - SaaS platforms MUST separate marketing landing pages, tenant user apps (`*.app.domain.com`), and administrative control planes (`admin.domain.com`) through edge middleware or platform routing rules.
4. **Zero Unencrypted Public Secrets in Container Deployments**:
   - Production Docker deployments on Railway or Fly.io MUST NOT bake `.env` files or secrets into images (`COPY .env`). Secrets MUST be injected via platform secret stores at runtime.

### Sovereign Execution, Token Efficiency & Invariants
| Dimension | Sovereign Mandate & Deterministic Contract |
| :--- | :--- |
| **Frontier Model Cascade** | Medium / High (`GPT-5.6 Sol Medium`, `Gemini 4 Argon`, `Claude Sonnet 5.5 High`, `Grok 4.7 High Fast`) |
| **Availability Fallback** | `Gemini 4 Argon/Pro` -> `Gemini 3.8 Flash`; `Claude Opus 5.5` -> `Claude Opus 4.6` (Zero unhandled missing-model errors) |
| **KV-Cache & Token Protocol** | Pin static instructions & schemas at prompt prefix (`kv-cache-prefix-optimizer`); pass surgical `CONTEXT_MAP.md` slices (<250 tokens/call) during Swarm Fan-Out |
| **SaaT CLI & MCP Dispatch** | CLI: `vibes skill exec cloud-hosting-expert <audit\|eval\|verify\|generate\|blueprint>` / MCP: `vibes_skill_dispatch`, `vibes_ast_query`, `vibes_compile_cache`, `vibes_optimize_budget`, `vibes_verify_gate` |
| **NFR & Anti-Slop Invariants** | Edge TTFB < 50ms (global P95), zero unencrypted image secret bakes, 100% ephemeral stateless runtime compliance; 100% complete zero-placeholder output verified via `node scripts/check-anti-slop.js --strict` |

---


---

<a name="bahasa-indonesia"></a>
## Bahasa Indonesia

### Integrasi Orkestrasi
- **Hulu & Orkestrasi**: `zero-to-prod-orchestrator` (Deployment Fase 7), `brainstorming`, `session-memory-manager`.
- **Pipeline CI/CD & Kontainer**: `ci-cd-devops-architect` (otomasi deployment), `github-actions-expert` (aksi cloud & OIDC), `docker-container-expert` (image kontainer Railway/Fly).
- **Komputasi Edge & Serverless**: `cloudflare-workers-expert` (Cloudflare Workers, D1, KV, R2), `api-gateway-proxy-expert` (routing edge & proxy).
- **Pemantauan & Auto-Remediasi**: `proactive-background-watcher` (pemeriksaan kesehatan deployment), `self-healing-cloud-orchestrator` (perbaikan otomatis crash produksi).
- **Sinergi Lintas Domain & Integrasi Swarm Subagent**: `kubernetes-gitops-platform-expert`

### Deskripsi
Panduan ahli untuk men-deploy aplikasi SaaS dan multiple entry points-nya (landing page, aplikasi, subdomain super admin) di platform edge dan serverless modern. Mencakup Vercel, Cloudflare Workers & Pages, Railway, Fly.io, dan **Cloudflare Workers AI** untuk workload AI di edge.

### Kondisi Pemicu
- Men-deploy aplikasi Next.js, Hono, atau Astro ke Vercel, Cloudflare, atau Railway.
- Mengonfigurasi domain kustom dan routing subdomain (`app.domain.com`, `admin.domain.com`).
- Menyiapkan Edge Middleware untuk identifikasi tenant multi-tenant.
- Men-deploy workload inferensi AI ke **Cloudflare Workers AI**.
- Men-deploy layanan backend long-running ke **Railway** atau **Fly.io**.

---

### Panduan Pemilihan Platform (2026)

| Platform | Pilihan Terbaik Untuk | Tier Gratis | Cold Start |
|---|---|---|---|
| **Vercel** | Next.js, situs statis, serverless functions | ✅ | ~200ms |
| **Cloudflare Workers** | API latensi ultra-rendah, logika edge | ✅ (100k req/hari) | ~0ms |
| **Cloudflare Pages** | Statis + full-stack (via Workers) | ✅ | ~0ms |
| **Railway** | Layanan Node.js/Bun/Go/Python long-running | ✅ ($5 kredit/bln) | Nol |
| **Fly.io** | Kontainer Docker terdistribusi global | ✅ (3 shared VM) | ~500ms |

---

### Implementasi Pola Kunci (TypeScript)

#### 1. Edge Middleware untuk Routing Subdomain & Tenant (Next.js 15)
```typescript
// middleware.ts
import { NextResponse } from 'next/server';
import type { NextRequest } from 'next/server';

export function middleware(request: NextRequest) {
  const hostname = request.headers.get('host') ?? '';
  const subdomain = hostname.split('.')[0];

  // Rute subdomain admin — tegakkan pemeriksaan otentikasi ketat
  if (subdomain === 'admin') {
    const sesiAdmin = request.cookies.get('admin-session')?.value;
    if (!sesiAdmin) {
      return NextResponse.redirect(new URL('/masuk', request.url));
    }
  }

  // Identifikasi tenant dari subdomain pada aplikasi multi-tenant
  if (subdomain !== 'www' && subdomain !== 'app' && subdomain !== 'admin') {
    const response = NextResponse.next();
    response.headers.set('x-tenant-slug', subdomain);
    return response;
  }

  return NextResponse.next();
}

export const config = {
  matcher: ['/((?!_next/static|_next/image|favicon.ico).*)'],
};
```

#### 2. Cloudflare Workers AI (Inferensi AI di Edge)
```typescript
export default {
  async fetch(request: Request, env: Env) {
    const { teks } = (await request.json()) as { teks: string };

    // Jalankan inferensi Llama 3.1 langsung di edge tanpa server eksternal
    const response = await env.AI.run('@cf/meta/llama-3.1-8b-instruct', {
      messages: [
        { role: 'system', content: 'Anda adalah asisten AI yang akurat.' },
        { role: 'user', content: teks },
      ],
      stream: true,
    });

    return new Response(response, {
      headers: { 'Content-Type': 'text/event-stream' },
    });
  },
};
```

#### 3. Railway Dockerfile untuk Runtime Bun Berkecepatan Tinggi
```dockerfile
FROM oven/bun:1.2-alpine
WORKDIR /app
COPY package.json bun.lockb ./
RUN bun install --frozen-lockfile
COPY . .
EXPOSE 3000
CMD ["bun", "run", "src/server.ts"]
```

### Matriks Eksekusi Berdaulat, Efisiensi Token & Invarian
| Dimensi | Mandat Berdaulat & Kontrak Deterministik |
| :--- | :--- |
| **Kaskade Model Frontier** | Medium / High (`GPT-5.6 Sol Medium`, `Gemini 4 Argon`, `Claude Sonnet 5.5 High`, `Grok 4.7 High Fast`) |
| **Invarian Fallback Ketersediaan** | `Gemini 4 Argon/Pro` -> `Gemini 3.8 Flash`; `Claude Opus 5.5` -> `Claude Opus 4.6` (Bebas gagal saat model belum tersedia/kuota penuh) |
| **Protokol Hemat Token & KV-Cache** | Kunci instruksi & skema statis di prefix awal (`kv-cache-prefix-optimizer`); kirim potongan `CONTEXT_MAP.md` (<250 token/panggilan) saat Fan-Out |
| **Eksekusi SaaT CLI & MCP** | CLI: `vibes skill exec cloud-hosting-expert <audit\|eval\|verify\|generate\|blueprint>` / MCP: `vibes_skill_dispatch`, `vibes_ast_query`, `vibes_compile_cache`, `vibes_optimize_budget`, `vibes_verify_gate` |
| **Invarian NFR & Anti-Slop** | TTFB Edge < 50ms (global P95), 0 rahasia terbakar dalam image kontainer, 100% kepatuhan stateless runtime efemeral; kode 100% tuntas tanpa placeholder diverifikasi melalui `node scripts/check-anti-slop.js --strict` |