CDN

Services

Open Graph

Renders Open Graph card images and the meta tags that point at them. One request returns the picture, a sibling request returns the markup that references it.

Context Cards

Serves the tagged ctx-cards build and its term packs from a pinned release, so a script tag on your page points at a version that cannot change under you.

How the host is structured

One Worker per service, each bound to a path rather than a hostname. A third Worker owns the root and acts as the directory.

cdn.jakelabate.com/open-graph/*      Open Graph service
cdn.jakelabate.com/context-cards/*   Context Cards service
cdn.jakelabate.com/                  directory and catch all

Cloudflare resolves overlapping routes by specificity, so the two service paths win over the catch all. This matters more than it looks: the hostname resolves to a proxied AAAA record at 100::, the IPv6 discard prefix, because a Workers route needs a DNS record to exist but nothing should actually be reachable at it. Without a Worker claiming the remaining paths, any unmatched request would be sent to an address that never answers and return a 522. The catch all turns that into a 404 that names the real mounts.

The alternative would be a Workers custom domain, which claims an entire hostname and provisions its own certificate. That is the simpler option when a host serves one thing. It cannot be used here, because Cloudflare will not attach a second Worker's route to a hostname another Worker holds as a custom domain.

Shared conventions

Both services follow the same rules, so behaviour is predictable across paths.

Immutable responses are cached for a year. Anything addressed by a version tag or by a complete set of rendering parameters carries max-age=31536000, immutable. Changing an input produces a different URL and therefore a new response, rather than invalidating an old one.
Cache keys are canonicalised. Parameter order never splits the cache, and parameters that do not affect the output are excluded from the key entirely.
Cross-origin reads are open. Both services are asset hosts. access-control-allow-origin is * on every response, and only GET, HEAD and OPTIONS are accepted.
Every service answers /health. It reports the resolved public base, which is the fastest way to confirm routing and configuration agree.
Failures degrade rather than cascade. A remote asset that cannot be fetched is dropped and the response is still served. A partial result beats a broken one.

Source

Both services are MIT licensed and self-hostable. The Workers are small enough to read in one sitting.

Open Graph serviceJakeLabate/og-cdn src

Context Cards serviceJakeLabate/ctx-cards cdn

Why first-party

Both of these could be served from a public mirror. Running them on a domain I control means the URL on a page belongs to me, the backing store can change without anyone editing a script tag, and there is no third party in the request path for something a page depends on at render time.

It also means the failure modes are mine to fix. A public CDN going down is an outage you can only wait out. This one I can redeploy.