Skip to content
Engineering

Cloudflare Enterprise Architecture, Zero-Trust Ingress & Edge Operations

The GERCIA Platform operates under a strict Zero-Trust Network Access (ZTNA) perimeter. No cloud service or database instance ever exposes open inbound listening ports (80, 443, 22, 5432) to the public internet.

All external traffic—whether from medical professionals accessing the SaaS portal, mobile patient apps, laboratory analytical balances, automated CI/CD pipelines, or engineering staff—is terminated at Cloudflare’s Global Anycast Edge and relayed either directly to static edge frontends (Cloudflare Pages) or through outbound-only Cloudflare Zero Trust Tunnels (cloudflared) to serverless workloads on Google Cloud Platform (GCP).

1. Zero-Trust Edge & Ingress Architecture

Section titled “1. Zero-Trust Edge & Ingress Architecture”

Traffic flows across segregated functional layers before touching application services or managed databases:

flowchart TD
    subgraph CLIENTS ["1. Clients & Ingress Actors"]
        USER_PUB["Public Visitors & Patients"]
        USER_B2B["B2B Clients (Doctors, Dentists, Vet Clinics & Pharmacies)"]
        STAFF["GERCIA Staff (Operations & SRE)"]
        MOBILE["Mobile App (GERCIA Care • KMP)"]
        EDGE_HW["Edge Hardware (Scales & Label Printers)"]
    end

    subgraph CF_PAGES ["2. Cloudflare Pages (Direct Edge Hosting)"]
        PAGE_SITE["gercia.com.br • gercia.vet.br<br>(Public Institutional Sites)"]
        PAGE_APP["app.gercia.com.br • app.gercia.vet.br<br>(B2B Angular Enterprise SPA)"]
        PAGE_DOCS["docs.gercia.com.br<br>(Public Help Center)"]
        PAGE_ENG["eng.gercia.com.br<br>(Internal Engineering Docs)"]
        PAGE_STATUS["status.gercia.com.br<br>(Out-of-Band Status Page)"]
    end

    subgraph CF_EDGE ["3. Cloudflare Edge & Zero Trust Gatekeeper (Pro Tier)"]
        WAF["Cloudflare WAF Pro & DDoS Protection"]
        POLISH["Polish & Mirage<br>(Medical Image & Prescription Optimization)"]
        ACCESS["Cloudflare Access (Identity-Aware Proxy)<br>• Google Workspace SSO (hd=gercia.com.br)<br>• Cloudflare WARP Device Posture<br>• Service Tokens (CF-Access-Client-Id / Secret)"]
        TLS["Edge TLS 1.3 Termination (Universal SSL *.gercia.com.br)"]
    end

    subgraph CF_TUNNEL ["4. Cloudflare Zero Trust Tunnels (cloudflared)"]
        T_PRD["gercia-tunnel-gcp-prd<br>(Private Routing to Cloud Run PRD)"]
        T_STG["gercia-tunnel-gcp-stg<br>(Private Routing to Cloud Run STG)"]
    end

    subgraph GCP_SERVICES ["5. Google Cloud Platform (southamerica-east1 - São Paulo)"]
        SERVER_PRD["Gercia.Server (Cloud Run Service • api & mcp)"]
        MIGRATOR_PRD["gercia-migrator (Cloud Run Job • --migrate)"]
        CLOUDSQL[(Google Cloud SQL for PostgreSQL<br>Private IP VPC Connector)]
    end

    USER_PUB -->|gercia.com.br, gercia.vet.br, docs, status| PAGE_SITE & PAGE_DOCS & PAGE_STATUS
    USER_B2B -->|app.gercia.com.br, app.gercia.vet.br| PAGE_APP
    STAFF -->|eng.gercia.com.br, ops.gercia.com.br| ACCESS --> PAGE_ENG

    USER_B2B & MOBILE & EDGE_HW --> WAF --> POLISH --> TLS
    STAFF --> ACCESS --> TLS

    TLS -- "Encrypted Tunnel Ingress" --> T_PRD & T_STG
    T_PRD --> SERVER_PRD
    SERVER_PRD & MIGRATOR_PRD --> CLOUDSQL

2. Canonical Ingress Rules & Routing Matrix

Section titled “2. Canonical Ingress Rules & Routing Matrix”

GERCIA operates authoritative Cloudflare routes under Cloudflare Account GERCIA and Zone gercia.com.br, mapping client requests to static edge applications or serverless backend services:

Subdomain / Route Ingress Target Target Technology Target Access Policy & Audience
gercia.com.br Institutional Marketing Portal Cloudflare Pages (apps/site - Astro 7) Public Internet
gercia.vet.br Sovereign Veterinary Marketing Portal Cloudflare Pages (apps/site-vet - Astro 7) Public Internet
app.gercia.com.br B2B Clinical & Pharmacy SaaS Portal Cloudflare Pages (apps/app - Angular 22 SPA) Public SaaS Ingress (Clinics, Doctors, Pharmacies)
app.gercia.vet.br B2B Veterinary SaaS Application Portal Cloudflare Pages (apps/app - Angular 22 SPA) Public SaaS Ingress (Veterinary Clinics, Pet Hospitals)
gercia.app Global Brand Defense & Mobile Redirect Cloudflare Pages / Direct Edge Public Internet (Redirects to GERCIA Care Mobile)
ops.gercia.com.br Internal Operations Backoffice Cloudflare Pages (@gercia/app Ops workspace) GERCIA Staff Only (Cloudflare WARP + Google SSO hd=gercia.com.br)
care.gercia.com.br GERCIA Care Smart Link Cloudflare Pages Public Internet (Redirects to App Store / Google Play)
docs.gercia.com.br Public Help Center & User Manuals Cloudflare Pages (docs/public - Astro Starlight) Public Internet
eng.gercia.com.br Internal Engineering & Architecture Portal Cloudflare Pages (docs/private - Astro Starlight) GERCIA Engineering Only (Cloudflare WARP + Google SSO)
status.gercia.com.br Sovereign Out-of-Band Status Page Cloudflare Pages (apps/status - Astro 7 + Svelte 5 + D1) Public Internet (Independent edge resilience)
assets.gercia.com.br Media, Prescription & Document Assets Cloudflare R2 Public Internet (Zero-egress object storage CDN)
api.gercia.com.br REST API Gateway & OpenIddict STS Google Cloud Run (Gercia.Server) via Tunnel Mobile Clients, Angular SPA, Edge Stations
mcp.gercia.com.br AI Model Context Protocol Host Google Cloud Run (Gercia.Server) via Tunnel AI Agents & Development Workflows
site-stg.gercia.com.br Staging Institutional Marketing Portal Cloudflare Pages (gercia-stg) GERCIA Staff Only (WARP + Google SSO)
app-stg.gercia.com.br Staging Multi-Tenant SaaS Portal Cloudflare Pages (gercia-app-stg) GERCIA Staff Only (WARP + Google SSO)
ops-stg.gercia.com.br Staging Operations Backoffice Cloudflare Pages (gercia-app-stg) GERCIA Staff Only (WARP + Google SSO)
app-stg.gercia.vet.br Staging Veterinary SaaS Application Cloudflare Pages (gercia-app-stg) GERCIA Staff Only (WARP + Google SSO)
docs-stg.gercia.com.br Staging Public Help Center Cloudflare Pages (gercia-docs-public-stg) GERCIA Staff Only (WARP + Google SSO)
eng-stg.gercia.com.br Staging Engineering & Architecture Portal Cloudflare Pages (gercia-docs-private-stg) GERCIA Engineering Only (Strict DevSecOps: devsecops@gercia.com.br + WARP)
status-stg.gercia.com.br Staging Status & Incident Drills Portal Cloudflare Pages (gercia-status-stg) GERCIA Staff Only (WARP + Google SSO)
api-stg.gercia.com.br Staging REST API Gateway Google Cloud Run (Gercia.Server Staging) via Tunnel Staging Web & Mobile Clients
mcp-stg.gercia.com.br Staging AI MCP Host Google Cloud Run (Gercia.Server Staging) via Tunnel Staging AI Agents

3. Cloudflare Access Applications, Identity Providers & Device Posture

Section titled “3. Cloudflare Access Applications, Identity Providers & Device Posture”

Cloudflare Zero Trust serves as the unified identity-aware perimeter for all internal and administrative services:

Identity Providers (IdP)

Section titled “Identity Providers (IdP)”
  • Google Workspace (google-apps): Sovereign enterprise directory enforcing corporate identity (@gercia.com.br) and multi-factor authentication (MFA) across 100% of protected applications and policies.

Reusable Access Policies Catalog

Section titled “Reusable Access Policies Catalog”
Reusable Policy Name Decision Enforced Security Controls Target Audience
Staff Corporate Access (WARP + BR) Allow • Cloudflare WARP client verified
• Geographic perimeter (Geo: BR)		 Authorized staff accessing backoffice (ops.*) and preview environments.
DevSecOps & SRE Only (WARP + BR) Allow • Google Workspace Group (devsecops@gercia.com.br)
• Cloudflare WARP client verified
• Geographic perimeter (Geo: BR)		 Engineering and SRE team accessing internal architecture portal (eng.*).
WARP Client Enrollment Allow • Authorized corporate emails (@gercia.com.br)
• Session duration: 24h		 Device onboarding and client key enrollment into the gercia.cloudflareaccess.com mesh.

Active Access Applications Matrix

Section titled “Active Access Applications Matrix”

All production backoffice endpoints, architecture documentation, and staging/preview deployments across Cloudflare Pages are centrally governed behind Cloudflare Access:

Application Name Secured Hostnames / Destinations Attached Policy App Launcher Security Posture & Scope
GERCIA Operations (Backoffice) ops.gercia.com.br Staff Corporate Access (WARP + BR) 🟢 Visível Production staff backoffice (@gercia/app). Google Workspace SSO • WARP • Geo BR • 24h session.
GERCIA Engineering (Architecture Portal) eng.gercia.com.br
eng-stg.gercia.com.br
*.gercia-docs-private.pages.dev		 DevSecOps & SRE Only (WARP + BR) 🟢 Visível Internal engineering architecture portal (docs/private). Strictly restricted to devsecops@gercia.com.br group (WARP + Geo BR).
GERCIA Staging (Pre-Production Portal) app-stg.gercia.com.br
ops-stg.gercia.com.br
app-stg.gercia.vet.br
docs-stg.gercia.com.br
status-stg.gercia.com.br
site-stg.gercia.com.br
site-stg.gercia.vet.br		 Staff Corporate Access (WARP + BR) 🟢 Visível Unified staging perimeter for pre-production services (Google Workspace SSO • WARP • Geo BR • Lazy Cookie issuance).
Preview: SaaS Application (*.gercia-app) *.gercia-app.pages.dev
gercia-app.pages.dev		 Staff Corporate Access (WARP + BR) 🔘 Oculto Protects Angular SPA staging, branch deployments, and PR previews against unauthenticated access.
Preview: Veterinary Portal (*.gercia-site-vet) *.gercia-site-vet.pages.dev
gercia-site-vet.pages.dev		 Staff Corporate Access (WARP + BR) 🔘 Oculto Protects Veterinary marketing portal staging and PR previews (apps/site-vet).
Preview: Institutional Website (*.gercia) *.gercia.pages.dev Staff Corporate Access (WARP + BR) 🔘 Oculto Protects institutional website staging and PR preview builds (apps/site).
Preview: Help Center (*.gercia-docs-public) *.gercia-docs-public.pages.dev Staff Corporate Access (WARP + BR) 🔘 Oculto Protects public Help Center staging and PR preview builds (docs/public).
Preview: Status Page (*.gercia-status) *.gercia-status.pages.dev Staff Corporate Access (WARP + BR) 🔘 Oculto Protects out-of-band status portal staging and PR previews (apps/status).
App Launcher gercia.cloudflareaccess.com Corporate Directory Portal — Central access portal for authorized GERCIA staff.
Warp Login App gercia.cloudflareaccess.com/warp WARP Client Enrollment — Zero Trust device enrollment for @gercia.com.br team members.

Service Auth, Infrastructure Targets & Cryptographic Trust Baseline

Section titled “Service Auth, Infrastructure Targets & Cryptographic Trust Baseline”

In alignment with ADR-007 and ADR-015, the Cloudflare Zero Trust perimeter enforces a zero-static-credential and zero-host posture:

  • Zero Static Service Tokens (0 Active Tokens): Following the decommission of legacy deployment webhooks (gercia-cloudbuild-portainer), all service tokens have been revoked. Automated CI/CD pipelines deploy through official Cloudflare Pages integrations and Google Cloud Build without long-lived static Access headers (CF-Access-Client-Id / CF-Access-Client-Secret).
  • Decommissioned SSH Certificate Authorities & Short-Lived Certificates: Cloudflare Access previously maintained an account-level SSH Certificate Authority (099fad93-dc1e-408d-8b02-2be531dee717 • open-ssh-ca@cloudflareaccess.org) to issue ephemeral short-lived SSH certificates for bare-metal host access. With all compute migrated to serverless Google Cloud Run containers, SSH bastions and host-level access have been eliminated, and the SSH CA has been permanently decommissioned (0 short-lived certificate CAs).
  • Zero-Target Infrastructure Inventory (0 Active Targets): The Zero Trust Infrastructure Targets catalog (infrastructure/targets) maintains strictly zero registered hosts. Cloud Run services communicate via outbound-only Cloudflare Tunnels and Serverless VPC Access Connectors, eliminating private IP targets and bastions.
  • Gateway-Managed Root CA (cc1c50b4-1441-4bab-bb7f-9b7208b62e12): The primary active certificate authority is the Cloudflare Gateway Root CA (Gateway CA - Cloudflare Managed G1), responsible for device posture verification, corporate DNS filtering, and secure proxying for enrolled WARP endpoints (A54 de Leonardo, guimaraes).

4. Cloudflare Pro Tier Capabilities & Edge Security Baseline

Section titled “4. Cloudflare Pro Tier Capabilities & Edge Security Baseline”

The GERCIA ecosystem operates under a Cloudflare Pro subscription (Zone ID 9b40462280303d298a2d0817c0b2b1d4), enforcing specialized edge-level optimizations:

Edge Transport & Cryptography Baseline

Section titled “Edge Transport & Cryptography Baseline”
  • SSL Mode: Full (Strict) (end-to-end encrypted transport from edge to Google Cloud Run origins).
  • TLS 1.3: Enabled with 0-RTT support for ultra-fast handshakes.
  • Minimum TLS Version: Enforced at TLS 1.2 (legacy TLS 1.0 and 1.1 strictly blocked at edge).
  • Always Use HTTPS: Enforced across all HTTP requests.
  • Brotli Compression: Enabled for aggressive compression of JSON payloads and static assets.
  • WebSockets & SSE: Enabled (supporting bi-directional streams and Server-Sent Events).

Advanced Web Application Firewall (WAF) & Managed Rulesets

Section titled “Advanced Web Application Firewall (WAF) & Managed Rulesets”
  • OWASP Core Ruleset: Real-time edge filtering for SQL injection (SQLi), Cross-Site Scripting (XSS), and Remote Code Execution (RCE).
  • Cloudflare Managed Ruleset: Zero-day exploit shielding and application vulnerability protection.
  • DDoS L7 Ruleset: Adaptive HTTP request flood and volumetric attack mitigation.
  • Exposed Credentials Check: Automated detection of credential stuffing against auth endpoints.

Medical Document & Prescription Optimization (Polish & Mirage)

Section titled “Medical Document & Prescription Optimization (Polish & Mirage)”

Compounding pharmacies and doctors continuously exchange high-resolution document scans, exam PDFs, and handwritten prescriptions:

  • Polish: Strips unnecessary EXIF metadata and applies lossless WebP/AVIF compression to clinical attachments, accelerating document rendering by up to 40%.
  • Mirage: Detects mobile device screen sizes and cellular network latency (3G/4G/5G), delivering adaptively scaled images to patients using the GERCIA Care mobile client.

5. SRE Troubleshooting & Diagnostic Runbook

Section titled “5. SRE Troubleshooting & Diagnostic Runbook”

When diagnosing ingress anomalies, connectivity drops, or HTTP errors, follow this structured diagnostic sequence:

A. Diagnosing HTTP 502 / 504 Bad Gateway & Gateway Timeout

Section titled “A. Diagnosing HTTP 502 / 504 Bad Gateway & Gateway Timeout”

An HTTP 502 or 504 error returned by Cloudflare indicates that Cloudflare’s Anycast Edge reached the tunnel, but the backend Cloud Run service was unreachable or timed out:

  1. Verify Cloud Run Service Status:
    Terminal window
    # Check if Cloud Run service is active and healthy
    gcloud run services describe gercia-server-prd --region=southamerica-east1 --project=gercia-gcp
  2. Inspect Cloud Run Health Probes:
    • Verify that the /health endpoint responds with HTTP 200 within the 5-second probe window.
    • If instances are scaling up from zero (cold start), verify that container startup time is under 4 seconds.
  3. Check Cloudflare Tunnel Status:
    Terminal window
    # Check tunnel status via Cloudflare API or CLI
    cloudflared tunnel info gercia-tunnel-gcp-prd

B. Instant Cache Purging for Cloudflare Pages

Section titled “B. Instant Cache Purging for Cloudflare Pages”

When static frontends or documentation updates are deployed, clear edge caches if updates do not appear immediately:

Terminal window
# Purge cache for a specific custom domain via Cloudflare API
curl -X POST "https://api.cloudflare.com/client/v4/zones/9b40462280303d298a2d0817c0b2b1d4/purge_cache" \
  -H "Authorization: Bearer $CF_API_TOKEN" \
  -H "Content-Type: application/json" \
  --data '{"hosts": ["app.gercia.com.br", "eng.gercia.com.br"]}'