Deployment
Where and how every Enjab tool is hosted and served.
Where every Enjab tool runs and how it is served to users. These rules are mandatory.
Host on Vercel by default
Always host on Vercel when it makes sense, which is almost always. It is free for our use, fast, and the platform the rest of the fleet runs on, so previews, rollbacks, and tooling stay consistent across every project. Reach for anything else only when a tool has a real requirement Vercel genuinely cannot meet.
On Vercel, TLS and the CDN are handled for you: you never manage certificates, and the Cloudflare rules below do not apply.
Hosting elsewhere (a VPS or your own server)
When a tool truly cannot run on Vercel and you host it on a VPS, the box itself must follow the Servers (VPS) standard (supported Ubuntu LTS on Hetzner, hardened with one command). On top of that, two rules about serving it are non-negotiable.
Put the domain behind Cloudflare (orange cloud)
Proxy the domain through Cloudflare with the orange cloud on (proxied), never grey-cloud / DNS-only. The orange cloud puts Cloudflare in front of your origin, so you get the CDN, DDoS protection, and a hidden origin IP for free, and it is what makes the HTTPS rule below work.
Let Cloudflare handle HTTPS
The origin serves plain HTTP. Cloudflare does all the TLS work at the edge, so the server never has a certificate to install, renew, or get wrong:
- Set the SSL/TLS encryption mode to Flexible. Cloudflare's edge certificate (Universal SSL, automatic and auto-renewed) encrypts the visitor-to-Cloudflare hop. The Cloudflare-to-origin hop is plain HTTP, so the origin needs no certificate and no cert validation.
- Turn on Always Use HTTPS so every visitor is upgraded to HTTPS at the edge.
- The origin listens on HTTP only and must not redirect to HTTPS itself (Cloudflare already presents HTTPS to the world; an origin-side redirect would loop).
Trade-off to be aware of: Flexible does not encrypt the Cloudflare-to-origin hop. That is the deliberate choice here for simplicity (no certs on the box). (None of this applies on Vercel, which does TLS for you.)