🏗️ Eliminate the single-CDN point of failure — backup subscription delivery

[sepehrsadri]

The Single Point of Failure

Our entire smart-subscription system depends on one Cloudflare account. If that account is ever terminated (a real risk for circumvention projects):

• ❌ sub.example.com goes down → all users lose VPN configs
• ❌ CDN-based protocols (XHTTP-CDN, CDN-WS, EDtunnel) stop working
• ❌ Clean IP rotation breaks
• ❌ No subscription URL delivery mechanism

What's at Risk

Component	Depends on CF	Fallback?
Smart-sub worker	✅	❌ None
Custom domain DNS	✅	❌ None
CDN proxying (4 cdn*.example.com)	✅	❌ None
SSL certificates	✅	❌ None
DDoS protection	✅	❌ None

Action Plan

Phase 1: Immediate Backup (This Week)

• Deploy worker.js as a standalone Node.js service on one of our servers (e.g., Helsinki)
• Set up Caddy reverse proxy for HTTPS on a backup domain
• Register a backup domain on a non-CF registrar (Namecheap, Porkbun)
• Test the backup endpoint end-to-end

Phase 2: Multi-CDN (This Month)

• Evaluate alternative CDNs: Gcore, Fastly, BunnyCDN, ArvanCloud
• Set up at least one CDN protocol path through a non-CF CDN
• Implement DNS failover (e.g., via NS1 or Route53)

Phase 3: Decentralized Distribution (Q2 2026)

• Telegram bot that serves subscription configs directly
• IPFS/IPNS-based config distribution
• Signal-based config sharing mechanism
• Peer-to-peer config relay via custom app

Architecture Reference

See RESEARCH-TOPICS.md — Topic 4: Distributed Architecture for full SPOF analysis.

---

Note on in-country testing. Measurement from inside a censored network is valuable, but this tracker is public: replying here to volunteer means self-identifying with a GitHub account. Please don't. Results are welcome via any channel you're comfortable with, and RIPE Atlas (already wired up in ripe-atlas-check.yml) gives a measurement path that puts no individual at risk.