Zero-Trust Network Topology & Subdomain Mapping
1. Zero-Trust Network Topology
Section titled “1. Zero-Trust Network Topology”The GERCIA ecosystem operates under a Defense-in-Depth Zero-Trust Network Architecture. No public ports or virtual machines are exposed directly to the public internet. All external ingress is routed through Cloudflare’s Anycast edge and relayed either directly to static edge frontends (Cloudflare Pages) or through encrypted Cloudflare Zero Trust Tunnels to serverless compute workloads on Google Cloud Platform (GCP) (Region: southamerica-east1 - São Paulo):
flowchart TD
subgraph Clients ["External Clients & Users"]
USER_PUB["Public Visitors & Patients"]
USER_B2B["B2B Clients<br>(Clinics, Doctors, Dentists, Vet Centers, Pharmacies)"]
STAFF["GERCIA Staff (WARP / Google SSO)"]
EDGE_HW["GERCIA Hub Workstations (Bench Scales & Printers)"]
end
subgraph Cloudflare_Edge ["Cloudflare Anycast Edge & Zero Trust"]
PAGES["Cloudflare Pages<br>(gercia.com.br • gercia.vet.br • app.gercia.com.br • app.gercia.vet.br • docs • eng • status)"]
CF_WAF["Cloudflare WAF & DDoS Shield<br>(Cloudflare Pro Tier)"]
CF_ACCESS["Cloudflare Access (Zero Trust)<br>(Google OIDC • WARP • Service Tokens)"]
R2["Cloudflare R2 Object Storage<br>(assets.gercia.com.br - Zero Egress)"]
TUNNEL["Cloudflare Zero Trust Tunnel<br>(Authenticated Service Tokens)"]
end
subgraph GCP ["Google Cloud Platform (southamerica-east1 - São Paulo)"]
subgraph Serverless_Compute ["Serverless Compute Tier"]
SERVER_SVC["Gercia.Server (.NET 10)<br>Google Cloud Run (Cloud Run Service)<br>REST API • OpenIddict STS • MCP AI Protocol<br>api.gercia.com.br • mcp.gercia.com.br"]
SERVER_JOB["Gercia.Server (.NET 10)<br>Google Cloud Run Job (gercia-migrator)<br>Pre-Deploy DDL Migrations (--migrate)"]
end
subgraph Managed_Data ["Managed Data & Security Tier"]
VPC["Serverless VPC Access Connector<br>(Private Internal Subnets - Zero Public IPs)"]
CLOUDSQL[(Google Cloud SQL for PostgreSQL<br>Multi-Tenant RLS • TLS 1.3 + SCRAM<br>Automated High Availability & PITR)]
GSM["Google Secret Manager (GSM)<br>Centralized Runtime Cryptographic Secrets"]
end
end
USER_PUB -- "gercia.com.br, gercia.vet.br & care" --> PAGES
USER_PUB -- "docs.gercia.com.br" --> PAGES
USER_B2B -- "app.gercia.com.br & app.gercia.vet.br (Angular SPA)" --> PAGES
STAFF -- "eng.gercia.com.br (Architecture)" --> CF_ACCESS
CF_ACCESS --> PAGES
USER_B2B -- "REST HTTPS / OAuth 2.1" --> CF_WAF
USER_B2B -.->|"Local HTTP/SSE (127.0.0.1:5050)"| EDGE_HW
USER_PUB -- "Public API Verification" --> CF_WAF
EDGE_HW -- "REST HTTPS (Outbox Long-Polling)" --> CF_WAF
CF_WAF --> TUNNEL
TUNNEL -- "Private Routing (api.gercia.*)" --> SERVER_SVC
TUNNEL -- "Private Routing (mcp.gercia.*)" --> SERVER_SVC
SERVER_SVC --> VPC
SERVER_JOB --> VPC
VPC --> CLOUDSQL
SERVER_SVC <--> GSM
SERVER_JOB <--> GSM
2. Cloud-Native Hosting Infrastructure (Google Cloud Platform)
Section titled “2. Cloud-Native Hosting Infrastructure (Google Cloud Platform)”In accordance with ADR-007, all persistent computing and data storage are hosted in Google Cloud Platform’s São Paulo region (southamerica-east1), eliminating legacy bare-metal operating system maintenance, physical single points of failure (SPOF), and manual backup overhead.
Cloud Infrastructure Specifications
Section titled “Cloud Infrastructure Specifications”| Infrastructure Layer | Technology Platform | Configuration & SLA Guarantees |
|---|---|---|
| Cloud Region | Google Cloud Platform | southamerica-east1 (São Paulo, Brazil) |
| Frontend CDN & Edge | Cloudflare Pages & R2 | Global Anycast CDN, HTTP/3, zero hosting cost, zero egress bandwidth fees |
| API & Application Hosts | Google Cloud Run (.NET 10) | Stateless serverless containers, automatic scale-to-zero, instant auto-scaling |
| Asynchronous Jobs & Migrations | Cloud Run Jobs (.NET 10) | Ephemeral database migration executions (--migrate) and report compilation |
| Managed Relational Persistence | Google Cloud SQL for PostgreSQL | Managed PostgreSQL with automated regional High Availability (HA) failover and Point-in-Time Recovery (PITR) |
| Network Ingress Protection | Cloudflare Zero Trust Tunnels | Zero public listening ports; outbound-only TLS 1.3 tunnels authenticated via Service Tokens |
| Runtime Secrets Management | Google Secret Manager (GSM) | Centralized, environment-suffixed cryptographic keys (_PRD and _STG) |
Strict Zero-Port Ingress Enforcement
Section titled “Strict Zero-Port Ingress Enforcement”3. Official Subdomain Mapping & Access Topology
Section titled “3. Official Subdomain Mapping & Access Topology”| Subdomain / Route | Target Service | Delivery Channel | Ingress Mechanism | Access Audience & Security Policy |
|---|---|---|---|---|
gercia.com.br |
Public Institutional Website | Cloudflare Pages | Direct Edge | Public Internet (Static Astro SSR/SSG) |
app.gercia.com.br |
B2B Multi-Tenant SaaS Portal (Human & Dental) | Cloudflare Pages | Direct Edge | Clinics, Doctors, Dentists, Compounding Pharmacies (@gercia/app Angular SPA) |
gercia.vet.br |
GERCIA Vet Institutional Website | Cloudflare Pages | Direct Edge | Public Internet (Static Astro SSR/SSG) |
app.gercia.vet.br |
B2B Veterinary SaaS Application Portal | Cloudflare Pages | Direct Edge | Veterinary Clinics, Pet Hospitals, MAPA Pharmacies (@gercia/app Angular SPA) |
ops.gercia.com.br |
Internal Platform Operations & Backoffice | Cloudflare Pages | Direct Edge | GERCIA Staff Only (Google Workspace OIDC • Cloudflare Zero Trust) |
gercia.app |
Global Brand Defense & Mobile Redirect Gateway | Cloudflare Pages | Direct Edge | Public Internet (Smart Redirect to GERCIA Care Mobile / App Stores) |
care.gercia.com.br |
GERCIA Care Mobile Landing & Smart Link | Cloudflare Pages | Direct Edge | Public Internet (Smart Redirect to App Store / Google Play) |
docs.gercia.com.br |
Public Help Center & User Manuals | Cloudflare Pages | Direct Edge | Public Internet, Doctors, Patients (Astro Starlight) |
eng.gercia.com.br |
Internal Architecture & Engineering Portal | Cloudflare Pages | Direct Edge | GERCIA Engineering Only (Cloudflare Zero Trust WARP / Google SSO) |
status.gercia.com.br |
Out-of-Band Status & Incident Portal | Cloudflare Pages | Direct Edge | Public Internet (Decoupled Anycast Edge • ADR-006) |
assets.gercia.com.br |
Global Media & Brand Asset Repository | Cloudflare R2 | Direct Edge | Public Internet (Zero-Egress Object Storage CDN) |
api.gercia.com.br |
Central REST API Gateway & Sovereign STS | Google Cloud Run (Gercia.Server) |
Cloudflare Tunnel | Mobile Clients, Angular SPA, Edge Stations (TLS 1.3 + OpenIddict) |
mcp.gercia.com.br |
AI Model Context Protocol (MCP) Host | Google Cloud Run (Gercia.Server) |
Cloudflare Tunnel | AI Agents & Internal Tooling (MCP Protocol / Host Routing) |
app-stg.gercia.com.br |
Staging B2B Multi-Tenant SaaS Portal | Cloudflare Pages (gercia-app-stg) |
Direct Edge | Zero Trust Protected (Staff Corporate Access: WARP + BR) |
site-stg.gercia.com.br |
Staging Institutional Marketing Portal | Cloudflare Pages (gercia-stg) |
Direct Edge | Zero Trust Protected (Staff Corporate Access: WARP + BR) |
site-stg.gercia.vet.br |
Staging Veterinary Marketing Portal | Cloudflare Pages (gercia-site-vet-stg) |
Direct Edge | Zero Trust Protected (Staff Corporate Access: WARP + BR) |
ops-stg.gercia.com.br |
Staging Platform Operations Backoffice | Cloudflare Pages (gercia-app-stg) |
Direct Edge | Zero Trust Protected (Staff Corporate Access: WARP + BR) |
app-stg.gercia.vet.br |
Staging Veterinary SaaS Application Portal | Cloudflare Pages (gercia-app-stg) |
Direct Edge | Zero Trust Protected (Staff Corporate Access: WARP + BR) |
docs-stg.gercia.com.br |
Staging Public Help Center | Cloudflare Pages (gercia-docs-public-stg) |
Direct Edge | Zero Trust Protected (Staff Corporate Access: WARP + BR) |
eng-stg.gercia.com.br |
Staging Architecture & Engineering Portal | Cloudflare Pages (gercia-docs-private-stg) |
Direct Edge | Zero Trust Protected (Strictly: devsecops@gercia.com.br + WARP) |
status-stg.gercia.com.br |
Staging Status & Incident Drills Portal | Cloudflare Pages (gercia-status-stg) |
Direct Edge | Zero Trust Protected (Staff Corporate Access: WARP + BR) |
api-stg.gercia.com.br |
Staging REST API Gateway & Sovereign STS | Google Cloud Run (Staging) | Cloudflare Tunnel | Zero Trust Protected (Staff Corporate Access: WARP + BR) |
gercia.dev |
Dedicated Local Development Domain | Cloudflare Loopback | 127.0.0.1 (Unproxied) | Local Developers (*.gercia.dev RFC 8252 OIDC loopback) |
4. Authoritative Cloudflare DNS Zone Architecture (gercia.com.br)
Section titled “4. Authoritative Cloudflare DNS Zone Architecture (gercia.com.br)”The platform’s authoritative DNS zone is orchestrated on Cloudflare with automated DNSSEC and TLS 1.3 termination. The zone maintains canonical records segregated into six functional domains:
flowchart TD
subgraph ZONE ["Authoritative DNS Zone: gercia.com.br"]
EDGE["1. Direct Edge & Static Frontends (Pages / R2)<br>gercia.com.br, app, docs, eng, status, assets, www, and *-stg"]
GCP_TUNNEL["2. Cloud Run Service Tunnels (PRD & STG)<br>api, mcp, api-stg"]
GWORKSPACE["3. Google Workspace Productivity<br>mail, calendar, drive, groups"]
EMAIL_CRYPTO["4. Email Security & Cryptography<br>SPF (Google/Mailgun), DKIM RSA-2048, DMARC (p=reject/none)"]
end
4.1. Direct Edge Frontends & Object Storage (Cloudflare Pages & R2)
Section titled “4.1. Direct Edge Frontends & Object Storage (Cloudflare Pages & R2)”All direct edge records are proxied (proxied: true) with Cloudflare CDN, DDoS mitigation, and HTTP/3 support:
| Record Name | Type | Target / Content | Proxy Status | Architectural Responsibility |
|---|---|---|---|---|
gercia.com.br |
CNAME |
gercia.pages.dev |
🟢 Proxied | Institutional public website (Astro on Cloudflare Pages) |
www.gercia.com.br |
CNAME |
gercia.pages.dev |
🟢 Proxied | Canonical WWW redirect alias |
app.gercia.com.br |
CNAME |
gercia-app.pages.dev |
🟢 Proxied | Enterprise B2B SaaS SPA (Angular 22 on Cloudflare Pages - @gercia/app) |
ops.gercia.com.br |
CNAME |
gercia-app.pages.dev |
🟢 Proxied | Internal Operations Backoffice (Angular 22 on Cloudflare Pages - @gercia/app) |
care.gercia.com.br |
CNAME |
gercia.pages.dev |
🟢 Proxied | GERCIA Care Mobile smart redirect and landing portal |
docs.gercia.com.br |
CNAME |
gercia-docs-public.pages.dev |
🟢 Proxied | Public Help Center & User Manuals (Astro Starlight) |
eng.gercia.com.br |
CNAME |
gercia-docs-private.pages.dev |
🟢 Proxied | Internal Architecture & Engineering Portal (Starlight + Zero Trust) |
status.gercia.com.br |
CNAME |
gercia-status.pages.dev |
🟢 Proxied | Out-of-band Status & Incident Portal (Astro 7 + Svelte 5 + Cloudflare D1 • ADR-006) |
assets.gercia.com.br |
CNAME |
public.r2.dev |
🟢 Proxied | Global brand media & public asset storage (Cloudflare R2) |
app-stg.gercia.com.br |
CNAME |
gercia-app-stg.pages.dev |
🟢 Proxied | Enterprise B2B SaaS SPA Staging Preview (@gercia/app on gercia-app-stg + Zero Trust) |
site-stg.gercia.com.br |
CNAME |
gercia-stg.pages.dev |
🟢 Proxied | Institutional Website Staging Preview (apps/site on gercia-stg + Zero Trust) |
ops-stg.gercia.com.br |
CNAME |
gercia-app-stg.pages.dev |
🟢 Proxied | Operations Backoffice Staging Preview (@gercia/app on gercia-app-stg + Zero Trust) |
docs-stg.gercia.com.br |
CNAME |
gercia-docs-public-stg.pages.dev |
🟢 Proxied | Public Help Center Staging Preview (docs/public on gercia-docs-public-stg + Zero Trust) |
eng-stg.gercia.com.br |
CNAME |
gercia-docs-private-stg.pages.dev |
🟢 Proxied | Engineering Architecture Portal Staging Preview (docs/private on gercia-docs-private-stg + Zero Trust) |
status-stg.gercia.com.br |
CNAME |
gercia-status-stg.pages.dev |
🟢 Proxied | Out-of-band Status Page Staging Preview (apps/status on gercia-status-stg + Zero Trust) |
4.2. Ingress Tunnels to Cloud Run Services
Section titled “4.2. Ingress Tunnels to Cloud Run Services”Traffic to backend API containers is securely bridged via Cloudflare Tunnels:
| Record Name | Type | Argo Tunnel Target FQDN | Target Service |
|---|---|---|---|
api.gercia.com.br |
CNAME |
2ba2ed17-c089-47b9-9b54-e2a777cec54f.cfargotunnel.com |
Gercia.Server (Cloud Run Production Server & STS) |
mcp.gercia.com.br |
CNAME |
2ba2ed17-c089-47b9-9b54-e2a777cec54f.cfargotunnel.com |
Gercia.Server (Cloud Run Production Server - MCP AI) |
api-stg.gercia.com.br |
CNAME |
8ffcae66-d741-4d25-b861-1261112ba122.cfargotunnel.com |
Gercia.Server (Cloud Run Staging Server) |
4.3. Google Workspace Productivity & Mail Routing
Section titled “4.3. Google Workspace Productivity & Mail Routing”Corporate mail exchanges and productivity endpoints:
| Record Name | Type | Priority / Target Content | Architectural Scope |
|---|---|---|---|
gercia.com.br |
MX |
1 smtp.google.com |
Primary corporate Google Workspace MX routing |
mail.gercia.com.br |
MX |
10 mxa.mailgun.org |
Primary Mailgun transactional dispatch cluster |
mail.gercia.com.br |
MX |
10 mxb.mailgun.org |
Secondary Mailgun transactional backup cluster |
track.mail.gercia.com.br |
CNAME |
mailgun.org (DNS only) |
Transactional email link click/open tracking |
mail.gercia.com.br |
CNAME |
ghs.googlehosted.com |
Corporate Gmail webmail ingress |
calendar.gercia.com.br |
CNAME |
ghs.googlehosted.com |
Corporate Google Calendar ingress |
drive.gercia.com.br |
CNAME |
ghs.googlehosted.com |
Corporate Google Drive ingress |
groups.gercia.com.br |
CNAME |
ghs.googlehosted.com |
Corporate Google Groups ingress |
4.4. Cryptographic Email Authentication (SPF, DKIM, DMARC)
Section titled “4.4. Cryptographic Email Authentication (SPF, DKIM, DMARC)”Defense-in-depth email authentication protecting corporate and tenant trust against phishing, spoofing, and unauthorized dispatches:
| Record Name | Type | Cryptographic Policy / Key Content | Security Guarantee |
|---|---|---|---|
gercia.com.br |
TXT |
"v=spf1 include:_spf.google.com ~all" |
SPF: Authorizes exclusively Google Workspace IP ranges for @gercia.com.br. |
mail.gercia.com.br |
TXT |
"v=spf1 include:mailgun.org ~all" |
SPF: Authorizes Mailgun sending clusters for transactional dispatches (@mail.gercia.com.br). |
google._domainkey.gercia.com.br |
TXT |
"v=DKIM1; k=rsa; p=MIIBIjANBgkq...IDAQAB" |
DKIM: High-assurance RSA 2048-bit digital signature for corporate emails. |
mx._domainkey.mail.gercia.com.br |
TXT |
"k=rsa; p=MIIBIjANBgkq...IDAQAB" |
DKIM: High-assurance RSA 2048-bit digital signature for transactional emails. |
_dmarc.gercia.com.br |
TXT |
"v=DMARC1; p=none; rua=mailto:...@dmarc-reports.cloudflare.net" |
DMARC: Telemetry & aggregate reporting routed to Cloudflare DMARC Analytics. |
_dmarc.mail.gercia.com.br |
TXT |
"v=DMARC1; p=none; pct=100; fo=1; ri=3600; rua=... ruf=..." |
DMARC: 100% forensic failure reporting for transactional email delivery. |
4.5. Google Workspace Collaborative Inboxes & Group Governance Matrix
Section titled “4.5. Google Workspace Collaborative Inboxes & Group Governance Matrix”GERCIA operates 10 standardized Google Workspace groups (@gercia.com.br) functioning as role-based distribution lists and collaborative inboxes:
| Primary Group Email | Recommended Aliases | Category / Scope | Primary Business Scope | Connected Platforms & Integrations |
|---|---|---|---|---|
devsecops@gercia.com.br |
sre@gercia.com.br |
Engineering & SRE | Infrastructure, GCP, CI/CD, database clusters, SRE, and security rules. | • Cloudflare Zero Trust (IdP Group Authorization) • Google Cloud Platform IAM |
dpo@gercia.com.br |
privacidade@gercia.com.br |
Governance & LGPD | Mandatory statutory channel (LGPD Art. 41) for data subject rights and ANPD correspondence. | • Public Privacy Policies • Data Protection Impact Assessments (DPIA / RIPD) |
contato@gercia.com.br |
contact@gercia.com.br |
Institutional & Sales | Public commercial and institutional entry point for institutional visitors and partners. | • Public website forms (gercia.com.br)• Corporate press and business development |
suporte@gercia.com.br |
support@gercia.com.brhelp@gercia.com.br |
Customer Support | Multi-channel operational and technical support for clinics, doctors, pharmacies, and patients. | • Public Help Center (docs.gercia.com.br)• SaaS Web Helpdesk ( app.gercia.com.br) |
financeiro@gercia.com.br |
billing@gercia.com.brcobranca@gercia.com.br |
Financial Operations | B2B SaaS subscription billing, electronic invoices (NF-e), accounts payable, and accounts receivable. | • Billing and subscription lifecycle module • External accounting partners |
pix@gercia.com.br |
— | Payments & Settlement | Official Central Bank corporate PIX key and dedicated channel for instant payment reconciliation. | • Banking PSP / Payment Gateways • Anti-phishing treasury isolation |
rh@gercia.com.br |
carreiras@gercia.com.brvagas@gercia.com.br |
People Operations | Talent acquisition, candidate resume intake, employee onboarding, benefits, and labor compliance. | • Recruitment portals and LinkedIn • Confidential employee records |
security@gercia.com.br |
seguranca@gercia.com.br |
InfoSec & Vulnerability | Official channel for responsible vulnerability disclosure, bug bounty, and threat advisories. | • RFC 9116 (/.well-known/security.txt)• CSIRT / CERT and Cloudflare security advisories |
alerts@gercia.com.br |
alertas@gercia.com.brnoc@gercia.com.br |
Telemetry & Observability | Automated machine-to-human alerting sink (eliminating alert fatigue in devsecops@gercia.com.br). |
• Cloudflare Health Checks (Status Page alerts) • Google Cloud Monitoring alerts |
compliance@gercia.com.br |
regulatorio@gercia.com.br |
Regulatory & Health | Sanitary notifications, technical audits, and regulatory correspondence (ANVISA RDC 67, CRF, CFM). | • Compounding pharmacy regulatory oversight • Medical council compliance |
5. Authoritative Cloudflare DNS Zone Architecture (gercia.vet.br)
Section titled “5. Authoritative Cloudflare DNS Zone Architecture (gercia.vet.br)”The sovereign veterinary vertical maintains a dedicated apex domain and Cloudflare DNS zone (gercia.vet.br), ensuring clean brand identity and distinct regulatory presentation for veterinary clinics, pet hospitals, and MAPA-licensed pharmacies:
| Record Name | Type | Target / Content | Proxy Status | Architectural Responsibility |
|---|---|---|---|---|
gercia.vet.br |
CNAME |
gercia-site-vet.pages.dev |
🟢 Proxied | Institutional veterinary website (Astro on Cloudflare Pages) |
www.gercia.vet.br |
CNAME |
gercia.vet.br |
🟢 Proxied | Canonical WWW redirect alias |
site-stg.gercia.vet.br |
CNAME |
staging.gercia-site-vet.pages.dev |
🟢 Proxied | Veterinary Website Staging Preview (apps/site-vet + Zero Trust) |
app.gercia.vet.br |
CNAME |
gercia-app.pages.dev |
🟢 Proxied | Enterprise B2B Veterinary SaaS Application (@gercia/app Angular SPA) |
app-stg.gercia.vet.br |
CNAME |
gercia-app-stg.pages.dev |
🟢 Proxied | Veterinary SaaS Application Staging Preview (@gercia/app on gercia-app-stg + Zero Trust) |
gercia.vet.br |
MX |
1 smtp.google.com |
🔘 DNS only | Primary corporate Google Workspace MX routing |
gercia.vet.br |
TXT |
"v=spf1 include:_spf.google.com ~all" |
🔘 DNS only | SPF: Authorized Google Workspace IP ranges |
google._domainkey.gercia.vet.br |
TXT |
"v=DKIM1; k=rsa; p=..." |
🔘 DNS only | DKIM: High-assurance RSA 2048-bit digital signature |
_dmarc.gercia.vet.br |
TXT |
"v=DMARC1; p=none; rua=mailto:...@dmarc-reports.cloudflare.net" |
🔘 DNS only | DMARC: Telemetry & aggregate reporting routed to Cloudflare DMARC |
6. Strategic Domain Portfolio & Brand Defense (gercia.app)
Section titled “6. Strategic Domain Portfolio & Brand Defense (gercia.app)”To safeguard corporate brand equity, prevent typosquatting, and establish a high-velocity mobile companion endpoint, GERCIA maintains ownership of the global gTLD gercia.app:
| Domain / Route | Target Service | Delivery Channel | Registry & Security Framework | Architectural Responsibility |
|---|---|---|---|---|
gercia.app |
Mobile Companion & Smart Redirect | Cloudflare Pages / Direct Edge | Google Registry (Built-in HSTS Preload) | Brand defense, mobile onboarding, and direct smart redirection to Apple App Store and Google Play (care.gercia.com.br). |
www.gercia.app |
Canonical Redirect | Cloudflare Pages / Direct Edge | Google Registry (Built-in HSTS Preload) | Canonical alias redirecting to gercia.app. |
Domain Extension Security & Regulatory DPN Analysis (Registro.br)
Section titled “Domain Extension Security & Regulatory DPN Analysis (Registro.br)”.app(Google Registry): Preloaded into Chromium’s HSTS preload list; browsers enforce strict HTTPS on all connections, eliminating unencrypted HTTP downgrade attacks..vet.br(Registro.br): Classified under professional categories, but permits registration by CPF/CNPJ without blocking CFM-style council validation at checkout. Operates with sovereign delegation on Cloudflare DNS..med.br/.far.br(Registro.br): Enforce strict verification (active CRM validation with CFM for.med.brand pharmacy/chemist CNAE with sanitary licensing for.far.br).
7. Dedicated Local Development Domain (gercia.dev)
Section titled “7. Dedicated Local Development Domain (gercia.dev)”The apex domain gercia.dev is owned and dedicated exclusively for local engineering and workstation development. Managed in Cloudflare DNS, the entire zone operates under a universal wildcard A record pointing to loopback (127.0.0.1):
| Record Name | Type | Target IP | Proxy Status | Architectural Scope |
|---|---|---|---|---|
*.gercia.dev |
A |
127.0.0.1 |
🔘 DNS only (Unproxied) | Universal wildcard resolving all local subdomains (app, api, docs, ops, vet) to the developer’s workstation |
@ (gercia.dev) |
A |
127.0.0.1 |
🔘 DNS only (Unproxied) | Apex domain loopback alias |
flowchart LR
subgraph DEV_WORKSTATION ["Developer Workstation (Local Host)"]
BROWSER["Browser<br>(https://app.gercia.dev:7250 • https://vet.gercia.dev:7250 • https://ops.gercia.dev:7250)"]
LOCAL_API["Local Gercia.Server<br>(127.0.0.1:5000)"]
end
subgraph CLOUDFLARE ["Cloudflare Authoritative DNS"]
WILDCARD["*.gercia.dev ➔ A ➔ 127.0.0.1<br>(Proxy Status: DNS Only / Grey Cloud)"]
end
BROWSER -- "1. DNS Query: app.gercia.dev / vet.gercia.dev" --> WILDCARD
WILDCARD -- "2. DNS Answer: 127.0.0.1" --> BROWSER
BROWSER -- "3. Local Angular SPA Dev Server (Port 7250 / TLS)" --> BROWSER
BROWSER -- "4. Direct REST Calls (Port 5000)" --> LOCAL_API
Mandatory Configuration Invariants:
Section titled “Mandatory Configuration Invariants:”- Strict DNS-Only Mode (Unproxied / Grey Cloud): The wildcard record MUST remain set to
DNS only. Enabling Cloudflare’s CDN Proxy (Orange Cloud) on127.0.0.1causes immediate traffic failure with CloudflareError 1000: DNS points to prohibited IP. - RFC 8252 Google OAuth Compliance: Google Cloud Identity and OAuth 2.0 strictly reject
.localor arbitrary internal TLDs withErro 400: invalid_request. The.devpublic TLD satisfies Google URI validation rules, enabling authentic Google Workspace OIDC redirects directly on developer machines. - Zero
hostsFile Maintenance: Any past, present, or future service (e.g.billing.gercia.dev,auth.gercia.dev,edge.gercia.dev) automatically resolves to127.0.0.1with zero operating system configuration. - Chromium HSTS Preload & SSL Invariant (
ssl: trueon Port 7250): Because the entire.devgTLD is preloaded in Chromium’s HSTS list, all modern browsers automatically upgradehttp://*.gercia.devtohttps://*.gercia.dev. The Angular CLI dev server is configured with"ssl": trueinapps/app/angular.jsonon port7250to serve self-signed TLS, preventingERR_SSL_PROTOCOL_ERROR.
8. Edge vs. Mobile Connection Security
Section titled “8. Edge vs. Mobile Connection Security”- Hardware Edges (
Gercia.Edge/ GERCIA Hub): Local workstation devices connect directly toGercia.Edgeat127.0.0.1:5050with sub-millisecond serial telemetry and silent thermal printing. Enterprise remote print servers authenticate via Secure Station Tokens (X-Station-Token) over TLS 1.3 through Cloudflare Tunnels to pull the cloud print outbox via long-polling. - Mobile Clients (
GERCIA Care): Authenticated using JWT (Access Token 15 min + Refresh Token Rotation 30 days) stored in hardware-backed secure storage (iOS Keychain / Android Keystore) combined with SSL Pinning to prevent Man-in-the-Middle (MitM) attacks.