Optimize CDN Configurations for Performance and Security

This skill covers CDN configuration, optimization, and management across major providers - CloudFlare, AWS CloudFront, Azure CDN, Google Cloud CDN, and Fastly - spanning caching strategy, edge computing, performance optimization, and security settings. Its caching strategy design tiers content by type: long TTL (31536000s / 1 year) for versioned static assets, short TTL (300-3600s) with proper cache headers for dynamic content, micro-caching (30-300s) for frequently requested API responses, and Edge-Side Includes for fragment caching personalized content. It covers Origin Shield configuration (reducing origin load via a shield point of presence nearest the origin server, with regional shields based on traffic patterns), CloudFront distribution setup via CloudFormation with managed cache/origin-request/response-header policies, Cloudflare Workers scripts for path-based caching logic, WAF and security headers (HSTS, X-Content-Type-Options, X-Frame-Options, X-XSS-Protection, CSP) via CloudFront Functions, Cloudflare rate limiting for DDoS protection, image optimization and compression settings (gzip and brotli), real user monitoring (RUM) for CDN performance metrics like TTFB and DNS/connect timing, and multi-CDN failover using Route53 DNS-based primary/secondary failover with health checks.

Use this skill when configuring or optimizing a CDN across CloudFront, Cloudflare, or another supported provider - it names concrete cache-hit-rate targets (over 90% for static content), TTL values, and specific policy IDs (Managed-CachingOptimized, Managed-CORS-S3Origin) rather than generic advice. It's well suited to setting up tiered caching by content type, hardening the edge with WAF/security headers, and building multi-CDN resilience with DNS failover. It is not a general web performance guide - it's scoped specifically to the CDN/edge layer (origin shields, cache policies, edge functions, DNS failover), not to application-level or database performance work. Its own closing guidance is to always test configurations in staging and roll out gradually with comprehensive monitoring, not to push CDN config changes straight to production.

### Nginx origin configuration
location ~* \.(jpg|jpeg|png|gif|webp)$ {
    expires 1y;
    add_header Cache-Control "public, immutable";
    add_header Vary "Accept";
    
    # Enable compression
    gzip on;
    gzip_types image/svg+xml;
}

Given a CDN provider and traffic pattern, the skill produces provider-specific configuration: CloudFront distribution templates with cache behaviors split by path pattern (long-TTL /static/* versus short-TTL /api/*), Cloudflare Workers scripts implementing path-based cache-control logic, security-header injection functions, rate-limiting configuration objects, origin-side compression and image-caching rules like the one above, a RUM script tracking DNS/connect/TTFB/download timing per navigation, and Route53 failover record sets for multi-CDN resilience.

Infrastructure and platform engineers configuring or hardening a CDN layer who need concrete, provider-specific templates - CloudFormation, Cloudflare Workers, CloudFront Functions, Nginx origin config - rather than abstract caching theory. It suits teams tracking cache-hit ratio, origin load reduction, TTFB, and error rates as core metrics, and that need cost-optimization guidance (price class selection, origin shield, compression, TTL tuning, reserved capacity for predictable traffic) alongside the technical configuration.