CDN and Edge Computing: Architecture, Caching Strategies, and Performance Optimization

cdn_benefits:
  latency_reduction:
    - "Edge servers close to users"
    - "Reduced round-trip time"
    - "Faster page loads"
  
  availability:
    - "Redundant server infrastructure"
    - "Load distribution"
    - "Failure failover"
    
  security:
    - "DDoS mitigation"
    - "WAF at edge"
    - "TLS termination"

class CDNArchitecture:
    """CDN request flow"""
    
    def request_flow(self, user_request):
        """Step-by-step CDN request handling"""
        
        # Step 1: User requests content
        user_ip = user_request.ip
        url = user_request.url
        
        # Step 2: DNS resolves to nearest edge
        edge_server = self.get_nearest_edge(user_ip)
        
        # Step 3: Edge checks cache
        if self.is_cached(edge_server, url):
            # Step 4a: Return cached content
            return self.serve_from_cache(edge_server, url)
        else:
            # Step 4b: Fetch from origin, cache, return
            content = self.fetch_from_origin(url)
            self.cache_at_edge(edge_server, url, content)
            return content
    
    def get_nearest_edge(self, user_ip):
        """GeoDNS returns closest edge server"""
        # Uses Anycast or GeoDNS
        pass

cdn_components:
  edge_servers:
    description: "Distributed servers closest to users"
    locations: "100-300+ PoPs worldwide"
    
  origin_servers:
    description: "Primary content source"
    role: "Fetch content on cache miss"
    
  control_plane:
    description: "Management and configuration"
    features: 
      - "Cache invalidation"
      - "Rule engine"
      - "Analytics"
    
  dns_system:
    description: "Routes users to optimal edge"
    methods:
      - "GeoDNS"
      - "Anycast"
      - "Latency-based routing"

class CacheTypes:
    """Different caching mechanisms"""
    
    CDN_CACHING_TYPES = {
        "static": {
            "description": "Static assets that rarely change",
            "examples": ["images", "CSS", "JS", "fonts"],
            "ttl": "1 year (with versioning)",
            "cache_control": "public, max-age=31536000"
        },
        
        "dynamic": {
            "description": "Content that changes frequently",
            "examples": ["API responses", "user-generated content"],
            "ttl": "Seconds to minutes",
            "cache_control": "private, max-age=60"
        },
        
        "semi_static": {
            "description": "Content with versioned URLs",
            "examples": ["hashed JS/CSS", "versioned images"],
            "ttl": "Long with cache-busting",
            "cache_control": "public, immutable"
        }
    }

class CacheControlStrategies:
    """Cache-Control header strategies"""
    
    @staticmethod
    def static_assets():
        """For images, CSS, JS, fonts"""
        return {
            "Cache-Control": "public, max-age=31536000, immutable",
            "ETag": "generated-hash",
            "Vary": "Accept-Encoding"
        }
    
    @staticmethod
    def api_responses():
        """For dynamic API content"""
        return {
            "Cache-Control": "public, max-age=60, s-maxage=300",
            "Vary": "Accept-Encoding, Authorization",
            "ETag": "content-hash"
        }
    
    @staticmethod
    def personalized_content():
        """For user-specific content"""
        return {
            "Cache-Control": "private, max-age=0, must-revalidate",
            "Vary": "Cookie, Authorization"
        }

class CacheInvalidation:
    """Different cache invalidation strategies"""
    
    # Method 1: Time-based (TTL)
    def ttl_based_invalidation(self, content, ttl):
        """Content expires after TTL"""
        # Set via Cache-Control header
        # max-age=3600 = 1 hour
        pass
    
    # Method 2: Purge/Invalidate API
    def purge_by_url(self, url):
        """Purge specific URL from CDN"""
        # POST /purge
        # {"urls": ["/page.html"]}
        pass
    
    # Method 3: Cache tags
    def invalidate_by_tag(self, tag):
        """Invalidate all content with specific tag"""
        # POST /purge
        # {"tag": "product-123"}
        pass
    
    # Method 4: Versioned URLs (Recommended)
    def versioned_urls(self, content_path, version):
        """Use version in URL for cache busting"""
        # /js/app.v2.js
        # /images/logo.v3.png
        # Cache forever, change version to update
        pass

edge_computing_benefits:
  reduced_latency:
    - "Process data at location nearest to source"
    - "Eliminates round-trip to origin"
    - "Real-time processing capability"
    
  bandwidth_savings:
    - "Filter/process data locally"
    - "Only send relevant data to origin"
    - "Reduce origin server load"
    
  enhanced_security:
    - "Data processed locally, not in transit"
    - "Reduce attack surface"
    - "Compliance with data residency laws"

class EdgeComputingUseCases:
    """Common edge computing scenarios"""
    
    USE_CASES = {
        "serverless_at_edge": {
            "description": "Run functions at edge locations",
            "providers": ["Cloudflare Workers", "AWS Lambda@Edge", "Vercel Edge"],
            "use_cases": [
                "A/B testing",
                "Geo-personalization",
                "Request authentication",
                "Response transformation"
            ]
        },
        
        "image_transformation": {
            "description": "Resize, optimize images at edge",
            "benefits": [
                "Reduce origin load",
                "Deliver optimal format (WebP/AVIF)",
                "Responsive images"
            ]
        },
        
        "real_time_analytics": {
            "description": "Process logs, events at edge",
            "examples": [
                "User behavior tracking",
                "Performance metrics",
                "Security filtering"
            ]
        },
        
        "iot_data_processing": {
            "description": "Process IoT data locally",
            "benefits": [
                "Low latency response",
                "Filter irrelevant data",
                "Aggregate before sending"
            ]
        }
    }

// Cloudflare Worker - Edge Function Example
addEventListener('fetch', event => {
  event.respondWith(handleRequest(event.request))
})

async function handleRequest(request) {
  const url = new URL(request.url)
  
  // A/B Testing at Edge
  const bucket = Math.random() < 0.5 ? 'control' : 'variant'
  
  // Geo-personalization
  const country = request.headers.get('CF-IPCountry')
  const localizedContent = await getLocalizedContent(country, url.pathname)
  
  // Request transformation
  const modifiedRequest = new Request(request, {
    headers: {
      ...request.headers,
      'X-Edge-Token': await generateToken(request)
    }
  })
  
  // Response transformation
  const response = await fetch(modifiedRequest)
  const modifiedResponse = new Response(response.body, response)
  modifiedResponse.headers.set('X-Cache-Status', 'HIT')
  
  return modifiedResponse
}

async function getLocalizedContent(country, path) {
  // Fetch and cache localized content
}

cdn_providers:
  cloudflare:
    features: 
      - "Free tier available"
      - "DDoS protection included"
      - "Workers edge compute"
      - "Image optimization"
    pricing: "Free tier, paid from $20/mo"
    
  aws_cloudfront:
    features:
      - "Deep AWS integration"
      - "Lambda@Edge"
      - "S3 integration"
      - "Field-level encryption"
    pricing: "Pay per use, $0.085/GB transfer"
    
  akamai:
    features:
      - "Largest network (365K+ servers)"
      - "Enterprise-grade"
      - "Advanced security"
      - "Real-time analytics"
    pricing: "Enterprise (custom pricing)"
    
  fastly:
    features:
      - "Real-time cache purging"
      - "Compute@Edge"
      - "VCL configuration"
      - "Excellent performance"
    pricing: "Pay per use, custom enterprise"
    
  cloudfront_vs_cloudflare:
    when_cloudfront:
      - "Deep AWS ecosystem usage"
      - "Complex origin authentication"
      - "Need Lambda@Edge"
      
    when_cloudflare:
      - "Simpler configuration"
      - "Need edge compute"
      - "Budget-conscious"
      - "Built-in security"

class CDNOptimization:
    """Best practices for CDN performance"""
    
    @staticmethod
    def optimize_cache_hit_ratio():
        """Improve cache hit ratio"""
        return {
            "long_ttl_static": "Set 1-year TTL for static assets",
            "versioned_urls": "Use content hashing in URLs",
            "appropriate_headers": "Set proper Cache-Control",
            "avoid_uncacheable": "Minimize query strings on static files",
            "cookie_handling": "Strip cookies for static assets"
        }
    
    @staticmethod
    def reduce_origin_requests():
        """Minimize origin server load"""
        return {
            "stale_while_revalidate": "Serve stale content while fetching new",
            "origin_shield": "Single edge fetches, others use cache",
            "compressed_origin": "Enable Brotli/Gzip at origin",
            "keep_alive": "Use persistent connections to origin"
        }
    
    @staticmethod
    def optimize_for_mobile():
        """Mobile-specific optimizations"""
        return {
            "edge_redirects": "Redirect to regional edge",
            "image_optimization": "Serve WebP/AVIF, resize at edge",
            "http2_push": "Preload critical resources",
            "service_workers": "Offline caching for repeat visits"
        }

protocol_optimization:
  http_2:
    advantages:
      - "Multiplexing (parallel requests)"
      - "Header compression"
      - "Server push"
      
  http_3:
    advantages:
      - "0-RTT connection establishment"
      - "No head-of-line blocking"
      - "Better mobile performance"
      - "Improved security"
      
  cdn_support:
    cloudflare: "HTTP/3 default, HTTP/2 optional"
    cloudfront: "HTTP/3 enabled by default"
    fastly: "HTTP/3 supported"

class CDNSecurityFeatures:
    """Security features provided by CDNs"""
    
    SECURITY_FEATURES = {
        "ddos_protection": {
            "description": "Mitigate volumetric attacks",
            "techniques": [
                "Anycast network",
                "Rate limiting",
                "Traffic scrubbing",
                "Behavioral analysis"
            ]
        },
        
        "waf": {
            "description": "Web Application Firewall",
            "rules": [
                "SQL injection prevention",
                "XSS protection",
                "Bot detection",
                "Geo-blocking"
            ]
        },
        
        "tls_encryption": {
            "description": "End-to-end encryption",
            "features": [
                "Automatic HTTPS",
                "Custom certificates",
                "TLS 1.3 support",
                "Certificate management"
            ]
        },
        
        "access_control": {
            "description": "Restrict access to content",
            "methods": [
                "Token authentication",
                "Referer validation",
                "IP whitelisting",
                "Signed URLs"
            ]
        }
    }

import hmac
import hashlib
import base64
import time

class SignedURLGenerator:
    """Generate signed URLs for protected content"""
    
    def __init__(self, secret_key):
        self.secret_key = secret_key.encode()
    
    def generate_signed_url(self, resource_url, expires):
        """Generate URL with embedded expiration"""
        expiry = int(time.time() + expires)
        
        # Create signature
        message = f"{resource_url}{expiry}"
        signature = hmac.new(
            self.secret_key,
            message.encode(),
            hashlib.sha256
        ).digest()
        
        signature_b64 = base64.urlsafe_b64encode(signature).decode()
        
        # Construct URL
        separator = '&' if '?' in resource_url else '?'
        signed_url = f"{resource_url}{separator}expires={expiry}&signature={signature_b64}"
        
        return signed_url
    
    def verify_request(self, url, signature, expires):
        """Verify signed URL is valid"""
        # Check expiration
        if int(time.time()) > int(expires):
            return False
        
        # Verify signature
        message = f"{url}{expires}"
        expected_signature = hmac.new(
            self.secret_key,
            message.encode(),
            hashlib.sha256
        ).digest()
        
        return hmac.compare_digest(
            base64.urlsafe_b64decode(signature),
            expected_signature
        )

anti_patterns:
  no_cache:
    - "Missing Cache-Control headers"
    - "Setting no-cache on static assets"
    - "Unnecessary query strings"
    
  poor_invalidation:
    - "Using short TTLs to compensate for no invalidation"
    - "Purging entire cache instead of specific paths"
    - "No cache versioning strategy"
    
  ignoring_mobile:
    - "Not optimizing for mobile"
    - "Serving full desktop images to mobile"
    - "No responsive image strategy"
    
  origin_overload:
    - "No origin shield"
    - "Cache everything for too long without invalidation"
    - "Not using stale-while-revalidate"

class CDNGoodPractices:
    """Recommended CDN practices"""
    
    BEST_PRACTICES = {
        "cache_strategy": {
            "static_assets": {
                "ttl": "1 year",
                "versioning": "content hash in URL",
                "headers": "public, immutable"
            },
            "api_responses": {
                "ttl": "1-5 minutes",
                "vary": "Authorization, Accept-Encoding",
                "stale_while_revalidate": "1 hour"
            }
        },
        
        "performance": {
            "enable_http23": "Use HTTP/3 for modern clients",
            "enable_brotli": "Better compression than gzip",
            "preconnect": "Pre-connect to CDN origins",
            "service_workers": "Client-side caching layer"
        },
        
        "security": {
            "always_https": "Redirect HTTP to HTTPS",
            "hsts": "Enable Strict-Transport-Security",
            "cors": "Configure proper CORS headers",
            "rate_limiting": "Protect origin from abuse"
        },
        
        "monitoring": {
            "cache_hit_ratio": "Target 95%+ for static",
            "origin_latency": "Monitor origin response time",
            "error_rates": "Track 5xx and 4xx errors",
            "bandwidth": "Monitor transfer costs"
        }
    }