01
Choose the runtime from the workload
Use the official Node server for a VM or container with filesystem access; use Deno or Cloudflare adapters for Fetch-native deployment. Cloudflare has no filesystem capability, so serve assets through the platform binding.
- Build once and deploy the matching adapter artifact.
- Keep runtime-specific code at the adapter boundary.
- Respect edge CPU, response-size, and storage limits.
02
Cache with data classification
Static public HTML can revalidate, fingerprintable assets can be immutable, while Actions, telemetry, sessions, account pages, and private HTML must not enter public shared caches.
- Use a CDN for static assets and public docs.
- Separate cache keys by tenant when caching public multi-tenant content.
- Send cache headers from the server or edge consistently.
03
Scale state externally
Horizontal scaling requires durable shared stores for sessions, authorization state, rate limits, idempotency, and queues. Process-local memory is appropriate only for development or one controlled process.
- Add a low-cost health endpoint.
- Record request IDs, latency, errors, and build version.
- Deploy with TLS, WAF/CDN controls, and a canary or rollback artifact.
NEXIS_SITE_ORIGIN=https://app.example.com pnpm check
NEXIS_SITE_ORIGIN=https://app.example.com pnpm build
import { createServer } from '@mohammedaydan/serve'
const app = createServer('./dist/client', {
host: process.env.HOST ?? '0.0.0.0',
port: Number(process.env.PORT ?? 4173),
actionOrigins: ['https://app.example.com'],
})
await app.listen()SCOPE BOUNDARY
Do not confuse a pattern with a built-in.
Set NEXIS_TRUST_PROXY=1 only when a trusted proxy removes client-supplied forwarded headers and writes trusted values. Never enable it on a directly exposed process.
PRACTICE LAB
Prove the behavior.
Create a cache matrix for docs, product pages, account pages, Actions, telemetry, and assets. Test the headers through the real deployment proxy.