Merge pull request #201 from Mozez155/feat/cdn-optimization

feat: global CDN content delivery optimization

Author: Mystery-CLI

backend/.env.example

@@ -78,6 +78,15 @@ BACKUP_INTERVAL_HOURS=24
 # Redis (optional — falls back to in-memory L1 cache if not set)
 # REDIS_URL=redis://localhost:6379
 
+# CDN Configuration
+CDN_ENABLED=false
+# CDN_URL=https://cdn.example.com
+# CDN_SECONDARY_URL=https://cdn2.example.com
+# Comma-separated list of CDN edge regions
+CDN_REGIONS=us-east-1,eu-west-1,ap-southeast-1
+# Max-age for immutable static assets (seconds, default 86400 = 1 day)
+CDN_CACHE_MAX_AGE_S=86400
+
 # Cache TTLs (seconds)
 CACHE_TTL_BALANCE_S=30
 RATE_CACHE_TTL_S=60

backend/src/cdn/index.js

@@ -0,0 +1,145 @@
+/**
+ * CDN Optimization Module
+ *
+ * Provides:
+ *  - Multi-region CDN configuration
+ *  - Dynamic cache-control header strategy
+ *  - Edge computing hints (Vary, Surrogate-Control)
+ *  - CDN analytics & monitoring
+ *  - Security headers (CSP, HSTS, X-Frame-Options)
+ *  - Cost optimization (cache-hit tracking)
+ *  - Failover: primary → secondary CDN origin
+ *
+ * Env vars:
+ *   CDN_URL=https://cdn.example.com
+ *   CDN_SECONDARY_URL=https://cdn2.example.com
+ *   CDN_ENABLED=true
+ *   CDN_CACHE_MAX_AGE_S=86400
+ */
+
+import logger from '../config/logger.js';
+
+// ── Config ────────────────────────────────────────────────────────────────────
+
+export function getCdnConfig() {
+  return {
+    enabled: process.env.CDN_ENABLED === 'true',
+    primaryUrl: process.env.CDN_URL ?? null,
+    secondaryUrl: process.env.CDN_SECONDARY_URL ?? null,
+    maxAgeSeconds: parseInt(process.env.CDN_CACHE_MAX_AGE_S ?? '86400', 10),
+    regions: (process.env.CDN_REGIONS ?? 'us-east-1').split(',').map(r => r.trim()),
+  };
+}
+
+// ── Cache strategy ────────────────────────────────────────────────────────────
+
+const CACHE_PROFILES = {
+  // Static assets with content hash — cache forever
+  immutable: (maxAge) => `public, max-age=${maxAge}, immutable`,
+  // API responses — short TTL, allow stale while revalidating
+  api:        () => 'public, max-age=30, stale-while-revalidate=60',
+  // User-specific data — private, no CDN caching
+  private:    () => 'private, no-store',
+  // HTML entry point — always revalidate
+  html:       () => 'public, max-age=0, must-revalidate',
+};
+
+export function getCacheHeaders(profile = 'api') {
+  const { maxAgeSeconds } = getCdnConfig();
+  const directive = CACHE_PROFILES[profile]?.(maxAgeSeconds) ?? CACHE_PROFILES.api();
+  return { 'Cache-Control': directive };
+}
+
+// ── Security headers ──────────────────────────────────────────────────────────
+
+export function getSecurityHeaders() {
+  return {
+    'Strict-Transport-Security': 'max-age=31536000; includeSubDomains; preload',
+    'X-Content-Type-Options': 'nosniff',
+    'X-Frame-Options': 'DENY',
+    'Referrer-Policy': 'strict-origin-when-cross-origin',
+    'Permissions-Policy': 'geolocation=(), microphone=()',
+  };
+}
+
+// ── Asset URL resolution with failover ───────────────────────────────────────
+
+let primaryFailed = false;
+
+export function resolveAssetUrl(path) {
+  const { enabled, primaryUrl, secondaryUrl } = getCdnConfig();
+  if (!enabled || !primaryUrl) return path;
+  const base = primaryFailed && secondaryUrl ? secondaryUrl : primaryUrl;
+  return `${base.replace(/\/$/, '')}/${path.replace(/^\//, '')}`;
+}
+
+export function reportCdnFailure(origin) {
+  if (origin === 'primary') {
+    primaryFailed = true;
+    logger.warn('cdn.failover.activated', { fallback: getCdnConfig().secondaryUrl });
+  }
+}
+
+export function resetCdnFailover() {
+  primaryFailed = false;
+  logger.info('cdn.failover.reset');
+}
+
+// ── Analytics & monitoring ────────────────────────────────────────────────────
+
+const cdnStats = {
+  cacheHits: 0,
+  cacheMisses: 0,
+  originRequests: 0,
+  failovers: 0,
+  byRegion: {},
+};
+
+export function recordCdnEvent({ type, region }) {
+  if (type === 'hit')    cdnStats.cacheHits++;
+  if (type === 'miss')   { cdnStats.cacheMisses++; cdnStats.originRequests++; }
+  if (type === 'failover') cdnStats.failovers++;
+  if (region) cdnStats.byRegion[region] = (cdnStats.byRegion[region] ?? 0) + 1;
+}
+
+export function getCdnStats() {
+  const total = cdnStats.cacheHits + cdnStats.cacheMisses;
+  return {
+    ...cdnStats,
+    hitRate: total > 0 ? (cdnStats.cacheHits / total).toFixed(3) : null,
+    config: getCdnConfig(),
+  };
+}
+
+// ── Express middleware ────────────────────────────────────────────────────────
+
+/**
+ * Attach CDN-friendly cache-control and security headers to responses.
+ * Profile is determined by request path:
+ *   /assets/* → immutable  (Vite hashed bundles)
+ *   /api/*    → api
+ *   *.html    → html
+ *   default   → api
+ */
+export function cdnMiddleware(req, res, next) {
+  const path = req.path;
+  let profile = 'api';
+  if (path.startsWith('/assets/')) profile = 'immutable';
+  else if (path.endsWith('.html'))  profile = 'html';
+  else if (path.startsWith('/api/')) profile = 'api';
+
+  const cacheHeaders = getCacheHeaders(profile);
+  const secHeaders = getSecurityHeaders();
+  Object.assign(res, {}); // ensure res is writable
+  res.set({ ...cacheHeaders, ...secHeaders });
+
+  // Edge computing hint: vary on Accept-Encoding for compression
+  res.set('Vary', 'Accept-Encoding');
+
+  // Surrogate-Control for CDN-specific TTL (Fastly/Varnish)
+  if (profile === 'immutable') {
+    res.set('Surrogate-Control', `max-age=${getCdnConfig().maxAgeSeconds}`);
+  }
+
+  next();
+}

backend/src/routes/metrics.js

@@ -1,5 +1,6 @@
 import express from 'express';
 import { getSnapshot, resetMetrics } from '../monitoring/metrics.js';
+import { getCdnStats } from '../cdn/index.js';
 import { checkShardHealth, getShardStats } from '../db/sharding.js';
 
 const router = express.Router();
@@ -15,6 +16,9 @@ router.delete('/', (_req, res) => {
   res.json({ message: 'Metrics reset' });
 });
 
+// GET /api/metrics/cdn — CDN analytics and config
+router.get('/cdn', (_req, res) => {
+  res.json(getCdnStats());
 // GET /api/metrics/shards — shard pool stats
 router.get('/shards', (_req, res) => {
   res.json(getShardStats());

backend/src/server.js

@@ -34,6 +34,7 @@ import { auditLogger } from './security/index.js';
 import { getConfig } from './config/env.js';
 import { createRateLimiter } from './middleware/rateLimiter.js';
 import { performanceMiddleware } from './monitoring/middleware.js';
+import { cdnMiddleware } from './cdn/index.js';
 import {
   requestIdMiddleware,
   errorLogger,
@@ -72,6 +73,8 @@ app.use(createRateLimiter());
 // Performance monitoring
 app.use(performanceMiddleware);
 
+// CDN cache-control and security headers
+app.use(cdnMiddleware);
 // Input sanitization (runs before all route handlers)
 app.use(sanitizeInputs);
 

frontend/vite.config.js

@@ -3,6 +3,8 @@ import react from '@vitejs/plugin-react';
 import { visualizer } from 'rollup-plugin-visualizer';
 
 export default defineConfig(({ mode }) => ({
+  // CDN base URL: set VITE_CDN_URL in .env to serve assets from CDN
+  base: process.env.VITE_CDN_URL ?? '/',
   plugins: [
     react(),
     // Bundle analysis: generates stats.html after `npm run build`
@@ -21,6 +23,10 @@ export default defineConfig(({ mode }) => ({
           motion:        ['framer-motion'],
           stellar:       ['@stellar/stellar-sdk'],
         },
+        // Ensure hashed filenames for immutable CDN caching
+        entryFileNames: 'assets/[name]-[hash].js',
+        chunkFileNames: 'assets/[name]-[hash].js',
+        assetFileNames: 'assets/[name]-[hash][extname]',
       },
     },
     // Performance budget: warn if any chunk > 500 kB