Edge DNS Router for Wildcard SaaS Sites
Profile:Tyber.io internal product
Built a Cloudflare Worker that routes `*.tyber.io` traffic to per-tenant content stored in R2 — including multi-page sites, auth-protected sites and reserved subdomains — without spinning up a backend for any of it.
Key results
The problem
An internal SaaS feature lets users provision microsites on `*.tyber.io` instantly: type a name, get a live site at `<name>.tyber.io` with HTML, images, and optional auth. Doing this with a traditional architecture (per-site VM, per-site nginx, per-site cert) is operational pain. Doing it with a single backend that fans out by hostname is a privacy and isolation risk.
The interesting question: can a Cloudflare Worker plus R2 be the entire backend?
The approach
One Worker, wildcard DNS, deterministic R2 keys.
Wildcard DNS at Cloudflare points `*.tyber.io` at a single Worker.
Reserved subdomain pass-through — a small allowlist (`www`, `api`, `dash`, `admin`, `mail`, `grafana`, `prometheus`, etc.) bypasses the Worker entirely and falls through to the original origins.
Path resolution — for any other subdomain, the Worker reads `sites/<sub>/index.html` from R2, or `sites/<sub>/<slug>.html` for multi-page sites, with `index.html` as fallback. Images live under `sites/<sub>/img/*.webp`.
Per-environment prefix — `sites` for prod, `sites-dev` for dev. Same Worker, same code, environment selected by Wrangler.
Auth marker — if `sites/<sub>/.auth` exists in R2, the Worker requires a `tyber_auth` cookie. Tokens are signed with MurmurHash3 and a per-user secret; expired or missing tokens get redirected to the auth flow.
Content type, caching, headers — set deterministically per file extension. WebP gets a 7-day cache, HTML gets a short cache with `must-revalidate`, etc.
The whole router is a single deployable Worker file plus an R2 bucket. No origin server, no SSL provisioning per subdomain, no DNS records per tenant.
The outcome
New tenant sites go live in seconds (the time it takes to `PUT` an HTML file into R2). Worker p95 latency stays under 10ms at edge. The reserved-subdomain allowlist keeps the rest of the platform untouched. Auth-protected sites work through the same Worker with no extra infra.
Why it matters
The edge has gotten good enough that for a real category of "static-ish, lots of tenants" workloads, a single Worker plus R2 is the entire backend. The interesting design choices are around the boring boundary stuff: which subdomains are reserved, how auth markers are distinguished from content, how multi-page sites resolve slugs, and how to keep prod and dev environments isolated in one bucket. Get the boundaries right and the rest is essentially free.
A similar engagement for your team?
Every Tyber.io engagement starts with the same question: which problem hurts the most, and which one is the most fixable. Get in touch with the technical lead directly — no SDR funnel, no junior handoff.
Talk to the technical lead