Edge DNS Router for Wildcard SaaS Sites
Profile:Tyber.io internal product
Built a Cloudflare Worker that routes wildcard traffic to per-tenant content stored in R2 — including multi-page sites, auth-protected sites and reserved subdomains — without spinning up a backend for any of it.
Key results
The problem
An internal SaaS feature lets users provision microsites on a wildcard domain instantly: type a name, get a live site at `<name>.<platform-domain>` with HTML, images, and optional auth. Doing this with a traditional architecture (per-site VM, per-site nginx, per-site cert) is operational pain. Doing it with a single backend that fans out by hostname is a privacy and isolation risk.
The interesting question: can a Cloudflare Worker plus R2 be the entire backend?
The approach
One Worker, wildcard DNS, deterministic R2 keys.
Wildcard DNS at Cloudflare points the whole wildcard at a single Worker.
Reserved subdomain pass-through — a short allowlist of platform subdomains bypasses the Worker entirely and falls through to the original origins. The list itself is configuration, never content.
Path resolution — for any other subdomain, the Worker reads `sites/<sub>/index.html` from R2, or `sites/<sub>/<slug>.html` for multi-page sites, with `index.html` as fallback. Images live under `sites/<sub>/img/*.webp`.
Per-environment prefix — `sites` for prod, `sites-dev` for dev. Same Worker, same code, environment selected by Wrangler.
Auth marker — a marker object stored alongside the tenant content tells the Worker that this site is private; without a valid signed session cookie the request is redirected to the auth flow. Token format and secret handling stay out of this writeup on purpose.
Content type, caching, headers — set deterministically per file extension. WebP gets a 7-day cache, HTML gets a short cache with `must-revalidate`, etc.
The whole router is a single deployable Worker file plus an R2 bucket. No origin server, no SSL provisioning per subdomain, no DNS records per tenant.
The outcome
New tenant sites go live in seconds (the time it takes to `PUT` an HTML file into R2). Worker p95 latency stays under 10ms at edge. The reserved-subdomain allowlist keeps the rest of the platform untouched. Auth-protected sites work through the same Worker with no extra infra.
Why it matters
The edge has gotten good enough that for a real category of "static-ish, lots of tenants" workloads, a single Worker plus R2 is the entire backend. The interesting design choices are around the boring boundary stuff: which subdomains are reserved, how auth markers are distinguished from content, how multi-page sites resolve slugs, and how to keep prod and dev environments isolated in one bucket. Get the boundaries right and the rest is essentially free.
A similar engagement for your team?
Every Tyber.io engagement starts with the same question: which problem hurts the most, and which one is the most fixable. Get in touch with the technical lead directly — no SDR funnel, no junior handoff.
Talk to the technical lead