Edge¶

The edge layer serves the CookieHub consent widget and related assets to end users. It is entirely on AWS, and mid-migration from Lambda@Edge to the edge-api service.

Scaleway PHP servers decommissioned

Widget serving previously ran on virtual servers hosted at Scaleway running raw PHP. Those servers have been decommissioned, completing the move off non-AWS infrastructure. edge-api's root dispatcher deliberately reproduces the old index.php routes (/, /log, /region, /v1/*, /v3/*), so the paths customers hit are unchanged.

Architecture¶

CloudFront + Lambda@Edge¶

AWS-managed CDN with Lambda@Edge functions for:

Region detection — determines user's region for consent law applicability
Consent logging — logs consent events at the edge before forwarding to the analytics pipeline

flowchart LR
    User[End user] --> CF[CloudFront]
    CF --> Lambda[Lambda@Edge]
    Lambda -->|region| User
    Lambda -->|consent log| SQS[SQS Queue]
    SQS --> Vault[Vault pipeline]

Being replaced

The /log Lambda@Edge function is being superseded by the edge-api service (below). In prod the cutover is partial — region-eu.cookiehub.net and consent-eu.cookiehub.net are served by edge-api, while consent.cookiehub.net and ds.cookiehub.net are still pending and remain on the legacy distribution. The Terraform module for this layer (modules/edge/cdn) is instantiated only in stage.

edge-api (Hono / Node.js on ECS)¶

TypeScript service replacing Lambda@Edge for consent event ingestion and introducing server-issued session identity. Handles widget traffic via CloudFront → ALB → ECS. Accepts v3 events with HMAC-signed session_proof and exposes a /v1/log compatibility endpoint for widgets still on v1 tokens.

flowchart LR
    User[End user] --> CF[CloudFront<br/>geo headers]
    CF --> ALB[Public ALB]
    ALB --> API[edge-api<br/>ECS service]
    API --> SQS[SQS Queue]
    SQS --> Vault[Vault pipeline]
    API --> CH[(ClickHouse<br/>read-only)]

Status: live in both environments.

Environment	Hostname	Notes
Stage	`edge-api.stage.cookiehub.net`	Dedicated hostname created by the module
Prod	`edge.cookiehub.net`	Prod sets `create_dedicated_hostname = false` — there is deliberately no `edge-api.cookiehub.net`. All traffic arrives through the `edge.cookiehub.net` CloudFront distribution, which fronts the public ALB

Prod runs 2 tasks (512 CPU / 1024 MB) on prod-euc1-edge-ecs-cluster. The ALB listener rule also accepts the legacy customer hostnames, so the two still pending (consent.cookiehub.net and ds.cookiehub.net) can be cut over by adding them to the distribution's aliases and Route53 — see the cutover status in environments/prod/eu-central-1/edge.tf, and the edge-api migration plan. Deployment runbook: Deployments → Edge API.

Infrastructure¶

Managed via Terraform — modules/edge/cdn/ for the CloudFront/Lambda layer and modules/edge/edge-api/ + modules/edge/ecs/ + modules/edge/ecr/ for edge-api. The two environments are not symmetrical: modules/edge/cdn is instantiated only in stage.

Stage¶

Component	Details
CloudFront distribution	CDN for widget assets + geo header enrichment
Lambda@Edge: region	Returns user's geographic region
Lambda@Edge: consent log	Processes v1 consent events (being replaced)
edge-api ECS service	Hono service on `stage-euc1-edge-ecs-cluster`
ECR: edge-api	Container registry for edge-api images
ACM cert (us-east-1)	`edge-api.stage.cookiehub.net` (CloudFront requirement)
SQS queue	Consent event buffer before vault ingestion
S3 buckets	Static asset storage

Prod¶

Component	Details
edge-api ECS service	2 tasks (512 CPU / 1024 MB) on `prod-euc1-edge-ecs-cluster` (c7i.large ASG)
CloudFront distribution	`edge.cookiehub.net` → public ALB, caching disabled, forwards all paths
ACM cert (us-east-1)	`edge.cookiehub.net`, with SANs for the legacy customer hostnames
ECR: edge-api	Container registry for edge-api images
SQS queue	Consent event buffer before vault ingestion
Lambda@Edge	Not managed here — `modules/edge/cdn` is stage-only

Prod deploys are triggered by GitHub Releases (tag refs) rather than branch pushes.

Dependencies¶

Vault pipeline — receives consent events via SQS (handles both v3 and v1 envelope formats)
S3 — widget assets and static files
ClickHouse — read-only dependency of edge-api for consent state lookup