✨ Cloudflare Migration - Move ⭐ Rewards (Mobile app) front door to Cloudflare free tier to reduce monthly hosting costs

[ssw-yakshaver]

Requested by: @chrisschultzssw via YakShaver.ai 🦬
cc: @chrisschultzssw, @Freego1783, @jernejk

Hi Team!

  🟥  Watch the video (42 sec)

  Url from screen share: https://portal.azure.com/#@sswcom.onmicrosoft.com/resource/subscriptions/bb18dcf-8d3b-47e2-9886-00c2e983629e/resourceGroups/ssw.rewards.prod/providers/microsoft.cdn/profiles/rewards/overview

Pain

Investigate and migrate the ⭐ Rewards (Mobile app) front door instance from its current paid setup (approximately $50 AUD/month) to Cloudflare’s free tier, aligning with other products that have already been successfully moved. The goal is to reduce ongoing infrastructure costs while maintaining performance, availability, and security.

Acceptance Criteria

1. The ⭐ Rewards (Mobile app) front door traffic is served through Cloudflare on the free tier
2. Monthly hosting costs related to the current front door setup are reduced or eliminated
3. No downtime or service interruption occurs during or after the migration
4. Application performance and latency are equal to or better than the current setup
5. DNS and routing are correctly configured to use Cloudflare
6. Security features (e.g. HTTPS, basic protection) remain in place after migration
7. Migration approach and configuration are documented for future reference

Screenshot

Figure: Rewards front door instance with recurring monthly cost, potential Cloudflare migration candidate

[jernejk]

🔍 Investigation / Refinement notes

What this front door actually is

The rewards resource (Microsoft.Cdn/profiles/rewards, Azure Front Door Standard, RG ssw.rewards.prod) is not the mobile API — it fronts the AdminUI / Blazor WASM web front-end, hosted as Azure Storage static websites, across all three environments on one profile:

Endpoint	Custom domain(s)	Origin (storage static site)
sswrewards (prod)	rewards.ssw.com.au	stsswrewardsadminprodybx.z8.web.core.windows.net
dev-rewards	dev.rewards.ssw.com.au, dev-rewards.ssw.com.au	stsswrewardsadmindevlwdm…
staging-sswrewards	staging.rewards.ssw.com.au	stsswrewardsadminstaging…

💲 Cost — the $50/mo estimate was a good call

The ~$50 AUD/mo in the request was a solid ballpark. Actuals from the Cost Management API are a bit lower but the same order of magnitude:

Period	Front Door rewards
May 2026 (full month)	$33.46 AUD
1 May – 26 Jun (~57 days)	$75.18 AUD (June trending higher)

So real recurring cost ≈ $33–42 AUD/mo (~$450/yr), almost entirely the Front Door Standard base fee. Cloudflare free = $0, so the saving is real — just ~$35–40/mo rather than $50. (Same playbook would also apply to the separate SophieCDN profile in this account.)

⚠️ Scope is bigger than "swap the front door" — 3 workstreams

1. Cloudflare setup — zone + proxied records to the storage origins, with Host-Header override (storage only answers on its *.web.core.windows.net host) and SSL mode Full (storage rejects plain HTTP). Recreate the BlazorCaching cache behaviour as Cloudflare Cache Rules: no-cache *.html + blazor.webassembly.js/dotnet.js, long/immutable cache /_framework/*. SPA deep-link fallback already lives at the origin (storage errorDocument_404Path = index.html), so Cloudflare just passes it through.
2. DNS — the gating dependency. ssw.com.au is on SSW's on-prem Windows DNS (not Azure/Cloudflare). Cloudflare free requires full-zone NS delegation (CNAME/partial setup is paid). Lowest-blast-radius approach: delegate just rewards.ssw.com.au as its own Cloudflare free zone via ~2 NS records added on-prem. Needs the DNS team.
3. Pipeline rewrite. admin-deploy.yml currently (a) creates/binds the BlazorCaching rule set and (b) purges the Front Door cache on every deploy (the "cache flush" step — ~7 explicit paths). Both must be re-pointed at Cloudflare. The purge maps cleanly to Cloudflare's free purge-by-URL API (≤30 URLs/call), so it's fully doable on free.

Security (AC6)

No WAF / security policy is attached today — "security" currently = managed HTTPS only. Cloudflare free meets/exceeds that. (Minor: prod route has HTTPS-redirect disabled — worth fixing during the move.)

✅ Recommended approach

Option A — delegate rewards.ssw.com.au as its own Cloudflare free zone. Lowest risk, hits every AC, keeps the rest of ssw.com.au untouched. (Option B = move all of ssw.com.au to Cloudflare — out of scope. Option C = Cloudflare for SaaS — paid, fails AC2.)

❓ Open questions before this is Ready

• Who owns the on-prem DNS change and what's the turnaround? (gates the cutover)
• Is there an existing SSW Cloudflare org the rewards zone should live under?
• How were the other products already migrated — same subdomain-delegation pattern? Reuse it.
• Confirm no WAF requirement before relying on Cloudflare-free managed protection only.

🤖 (Checked by JK)