Back to blog
Tutorial

Cloudflare as complete infrastructure

By Flávio Emanuel · · 6 min read

I spent way too long thinking Cloudflare was just DNS with DDoS protection. Then I realized it’s basically complete infrastructure for an application.

Today my standard setup for clients is Cloudflare from end to end. DNS, proxy, CDN, storage, functions, email. All there. Reduces the need to wire together five different services.

DNS and proxy: the foundation

Every site starts here. You point your domain to Cloudflare and you’re done. They sit between your server and the client. This automatically activates their global cache.

You flip Full mode on and SSL certs are managed automatically. Free. That alone justifies using Cloudflare.

They have servers on basically every continent. Your site gets served from a data center near the user. Latency drops noticeably. Not marketing, it’s real in speed tests.

R2: your S3, but cheaper

R2 is object storage. S3 compatible. Works for storing anything: images, PDFs, videos.

Here’s the thing: zero egress charges. Amazon S3 charges heavy ($0.09 per GB out) when you download files. Cloudflare R2 doesn’t charge for outbound. You pay $0.015 per GB stored and $4.50 per million requests.

A clinic website with 500 before/after photos? About 200MB. Costs $3 monthly in storage. Downloads are free. Compare that to S3 which would charge $20+ in egress.

Setup is straightforward. Create a bucket, upload images, use the public URL. You can put it behind Cloudflare CDN or not. I always do because it’s extra caching.

I migrated images for a client who was paying $50/month just in S3 costs. Moved to R2, now pays $5. He thought I was a wizard.

Workers: edge functions built in

Workers is how Cloudflare runs code at the edge. You write JavaScript or TypeScript, deploy it straight. Executes anywhere on the planet.

What’s it for? Form validation before hitting your server. URL rewrites. Authentication. Dynamic redirects. You put logic close to the user, not on your server.

Pricing is $0.50 per million requests. To put it in perspective, you can run 2 million requests monthly and spend $1.

Code stays versioned in Git. Deploy is one command. I use it for small validations and redirects. Works great.

Integrates perfectly with R2. You take a file upload via Worker, validate size/type, save to R2. All in one place.

Durable Objects: persistent state

Durable Objects handles persistent state at the edge. Like a session, a counter, a queue.

Real example: client has appointment booking form. Needs to know how many appointments were booked today. With Durable Objects you keep that right at the edge near the user. Zero latency.

Pricing is $0.20 per million requests for read/write plus storage cost. More expensive than plain Workers. Only use it when you actually need stateful logic.

Email Routing: SMTP without the cost

Cloudflare Email Routing lets you receive emails on your domain without managing an email server.

You ditch whatever email service (expensive or cheap, doesn’t matter) and point straight to your email provider of choice. I forward to Gmail. Separate inbox but organized.

Here’s the thing: it’s free.

A real setup I use

For a clinic website:

  1. Domain points to Cloudflare
  2. Pages or another place as your actual host
  3. R2 to store before/after photos
  4. Worker that validates appointment form
  5. Durable Object that manages waiting list
  6. Email Routing to receive contact forms

Monthly cost? Maybe $5-10 in R2 depending on volume. Everything else is free or close to it.

Wiring all of that together would be a pain if you had to combine six different services. Here it’s in one place. One interface. One account to manage.

The downsides

Cloudflare is powerful but it’s also confusing. Documentation is massive. If you don’t know what you’re doing you can make security mistakes.

Also: the interface changes constantly. Things move around. You learn where something is and next month it’s somewhere else.

Free tier support is slow. But for most problems the community answers quickly on their Discord.

Security is solid. But you need to understand rate limiting, WAF rules, DDoS protection. It’s not set and forget.

Is it worth it?

Depends on your project. For a static or simple dynamic site, yes. Cloudflare Pages is free and fast. For something needing more infrastructure customization, maybe Vercel makes more sense.

I like it because I save client money, centralize infrastructure, and learn something new. At first it felt confusing. Now it’s routine.

If you want to learn modern infrastructure without spending money and without AWS complexity, Cloudflare is the best starting point. Really.

Analytics Engine: built-in observability

There’s one more feature worth mentioning: Analytics Engine.

You can make requests to Workers and log custom events. Like, a patient completed an appointment booking? Send event to Analytics Engine. Query later with ClickHouse-like queries.

Price is $0.50 per million events.

Not revolutionary, but useful when you want analytics without setting up Datadog or similar.

Limits that matter

Cloudflare has limits. You need to know them:

R2: $0.015 per GB/month storage is cheap, but 50GB is a normal limit for free tier.

Workers: you can make requests anywhere, but 30-second timeout on free tier (enough for 99% of cases).

Durable Objects: write limit is 1,000 per second per instance. If your app gets more aggressive, scale up.

Page Rules: free tier gets 3 rules. After that, you pay.

You probably won’t hit most of these. But knowing they exist prevents surprises.

When Cloudflare is NOT the solution

Cloudflare is great for most. But some cases exist where it’s not:

Need GPU computing (machine learning, heavy image processing)? Cloudflare doesn’t have it.

Need traditional SQL database with complex ACID transactions? Workers isn’t it. KV is key-value, not relational.

In strict compliance regime (healthcare, finance)? Need more rigorous auditing than Cloudflare offers.

In those cases, go back to Vercel + Supabase or AWS.

Security: not set-and-forget

One final important point: Cloudflare is powerful in security, but needs setup.

WAF (Web Application Firewall) has pre-made rules, but you need to tune them. Rate limiting needs configuration. DDoS protection is automatic but you can add rules.

If you set up Cloudflare but configure nothing, you’re using 10% of the features.

My tip: spend 2-3 hours learning WAF rules, rate limiting, browser integrity check. After that it’s genuinely secure.

  • Migrate images to R2
  • Create first Worker with validation logic
  • Test Email Routing on my domain
  • Read Durable Objects and Analytics documentation
  • Configure basic WAF rules
  • Quote Cloudflare setup for next client

Read also: Deploy beyond Vercel | Edge computing in practice | Image optimization for web

Cloudflare is your best friend if you learn to speak its language.

Next step

Need a dev who truly delivers?

Whether it's a one-time project, team reinforcement, or a long-term partnership. Let's talk.

Chat on WhatsApp

I reply within 2 hours during business hours.