Ask ten engineers for a production architecture and you will get ten diagrams, but for a small team shipping a web product, one pairing keeps winning on cost and calm: Cloudflare managing the domain and the edge, a managed platform running the application.
Division of labor
Each layer does what it is best at:
- Cloudflare answers DNS, terminates TLS close to the visitor, caches static assets worldwide, and absorbs abusive traffic before it costs you compute. The essentials are covered in what Cloudflare actually does.
- The managed platform builds from Git, runs the server process, holds secrets, and scales the app, the territory mapped in managed app hosting explained.
Wiring it together
The connection is one CNAME record pointing your domain at the platform's endpoint, proxied through Cloudflare. Set SSL mode to Full (strict) so the leg between Cloudflare and your host is verified, not just encrypted; the lesser modes exist for legacy reasons and quietly weaken the chain. From there, sensible defaults: cache static assets aggressively, leave API routes uncached, and turn on bot filtering for your forms alongside an invisible human check.
What this buys you
Two dashboards, no servers to patch, and each layer replaceable without touching the other, which is exactly the kind of reversible decision worth defaulting to. The failure modes are covered too: the edge rides out traffic spikes, the platform restarts a crashed process, and your monitoring tells you about both. It is not the architecture for every company at every size, but it is the one to deviate from only when a real constraint demands it.