Cloudflare · Partially-Managed Zone

Request flow: app.idoelenberg.com → Worker → On-Prem Resource

Customer's authoritative DNS keeps ownership of idoelenberg.com and CNAMEs a wildcard record onto Cloudflare's partial zone. The proxied hostname hits a Worker, which reaches on-prem through two independent bindings—each with its own VPC Service—crossing into the datacenter over a shared Cloudflare Tunnel.

PUBLIC INTERNET CLOUDFLARE NETWORK ON-PREM DATACENTER 1 · resolve app.idoelenberg.com 2 · CNAME → Cloudflare edge (proxied) 3 · Workers Route env.DB.query( … ) env.VPC.fetch / connect Cloudflare Tunnel · outbound mTLS Cloudflare Tunnel · outbound mTLS private network delivery End user GET https://app.idoelenberg.com/ CUSTOMER · AUTHORITATIVE DNS External DNS provider Route 53 / GoDaddy / etc — owns idoelenberg.com ; idoelenberg.com zone *.idoelenberg.com CNAME edge.cf-cdn.net. CLOUDFLARE · PARTIAL ZONE Wildcard proxied record *.idoelenberg.com → matches app.idoelenberg.com WILDCARD COMPUTE Worker application Two independent bindings DATA BINDING Hyperdrive mapping Pooled DB access · edge cache PRIVATE EGRESS · A VPC Service (Hyperdrive) Owns Hyperdrive's origin route PRIVATE EGRESS · B VPC Service (direct binding) Owns Worker's raw TCP/HTTP route TRANSPORT cloudflared connector Outbound-only to Cloudflare shared by both VPC services TARGET Internal resource DB / internal API / service 10.20.30.40 · svc.corp.internal
DNS resolution
Cloudflare-managed hop
Tunnel / private-network hop
Cloudflare network
On-prem datacenter
Public internet