max / makenotwork

docs: drop retired dl.maxj.phd from scaling topology Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: Max Johnson <me@maxj.phd> · 2026-07-12 14:33 UTC

Commit: 6367d3c3650f5e38bc6dc4c3c3f60fedda5477dc

Parent: 4c6a323

1 file changed, +2 insertions, -2 deletions

M server/docs/scaling.md +2 -2

			@@ -8,9 +8,9 @@ Capacity assessment of the production stack and the upgrade path from current st
8	8
9	9		CCX13 = 2 dedicated vCPU / 8 GB RAM / 80 GB NVMe + 10 GB volume, ~20 TB included monthly egress.
10	10
11		-	Edge — Cloudflare proxy ON for `makenot.work`, `.makenot.work`, `.maxj.phd` (e.g. `dl.maxj.phd`), `htpy.app`. Full (Strict) SSL via Origin CA wildcards. Authenticated Origin Pulls (mTLS) — origin only accepts the Cloudflare client cert. `cdn.makenot.work` reverse-proxies to Hetzner Object Storage (`fsn1`), with Cloudflare caching at the edge.
	11	+	Edge — Cloudflare proxy ON for `makenot.work`, `*.makenot.work`, `htpy.app`. Full (Strict) SSL via Origin CA wildcards. Authenticated Origin Pulls (mTLS) — origin only accepts the Cloudflare client cert. `cdn.makenot.work` reverse-proxies to Hetzner Object Storage (`fsn1`), with Cloudflare caching at the edge.
12	12
13		-	Custom domains — creator domains bypass Cloudflare and point at the origin directly, where Caddy issues on-demand TLS (LE HTTP-01, gated by `/api/domains/caddy-ask`). Stable routing target: `connect.makenot.work` (A → origin IP, proxy OFF) — customers CNAME to it (apex via flattening) so the origin IP can change in one place. The apex `maxj.phd` dogfoods this exact path: it is a verified custom domain, DNS-only (CNAME-flattened → `connect.makenot.work`), served by the on-demand-LE catch-all — not a CF-proxied zone. (`dl.maxj.phd` stays CF-proxied with its own Origin CA cert + mTLS.)
	13	+	Custom domains — creator domains bypass Cloudflare and point at the origin directly, where Caddy issues on-demand TLS (LE HTTP-01, gated by `/api/domains/caddy-ask`). Stable routing target: `connect.makenot.work` (A → origin IP, proxy OFF) — customers CNAME to it (apex via flattening) so the origin IP can change in one place. The apex `maxj.phd` dogfoods this exact path: it is a verified custom domain, DNS-only (CNAME-flattened → `connect.makenot.work`), served by the on-demand-LE catch-all — not a CF-proxied zone.
14	14
15	15		Object storage — Hetzner S3 (`fsn1` Frankfurt), presigned PUT/GET. Separate buckets for content and SyncKit blobs.
16	16