Azure Front Door Architecture

What is Azure Front Door?

Azure Front Door is Microsoft's modern cloud Content Delivery Network (CDN) that provides fast, reliable, and secure access to our global web applications. It acts as the single global entry point for all 54 of our custom domains, routing traffic to the appropriate backend services based on intelligent rules and health monitoring.

Core Capabilities

• Global Load Balancing: Distributes traffic across multiple backend servers for optimal performance and reliability
• SSL/TLS Termination: Handles HTTPS encryption at the edge, reducing backend server overhead
• Health Monitoring: Continuously checks backend servers every 30 seconds via /api/health endpoints
• CDN Acceleration: Caches static content at edge locations worldwide for faster delivery
• Intelligent Routing: Routes requests based on domain, path, geography, and backend health
• DDoS Protection: Built-in protection against distributed denial-of-service attacks

QI3IX Front Door Infrastructure by the Numbers

Request Flow Architecture

Step-by-Step Request Processing

1. DNS Resolution: User's browser resolves www.drantech.ai to Front Door's global endpoint
2. Front Door Reception: Request hits nearest Azure edge location (global anycast)
3. SSL Termination: Front Door decrypts HTTPS traffic using managed SSL certificate
4. Route Matching: Front Door matches domain to specific route (drantechai-route)
5. Health Check Verification: Confirms origin group backend is healthy (recent /api/health probe succeeded)
6. Backend Selection: Selects healthy backend from origin group (Dranschak-East2-App)
7. Request Forwarding: Forwards request to App Service over Azure backbone network
8. Response Delivery: Flask app processes request, returns response through Front Door to user
9. CDN Caching: Static assets cached at edge for subsequent requests

Domain Inventory (54 Total)

Production Domains (7 Active) LIVE

Strategic Reserve Domains (47 Total) HOLDING PAGE

The following domains are registered and configured in Front Door but serve a professional "Coming Soon" holding page. They route to the holding-page-origin-group origin group.

Origin Groups Configuration (14 Total)

Origin groups are logical collections of backend servers. Front Door routes traffic to origin groups, which then distribute requests across their configured origins (App Services or Static Web Apps). Each origin group includes health probe settings to monitor backend availability.

Flask App Service Origin Groups (5 Total)

Static Web App Origin Groups (9 Total)

These origin groups serve Azure Static Web Apps. Most are internal development environments or specialized deployment targets. They typically use / as the health probe path (default for static sites).

Route Configuration Strategy

QI3IX uses a one route per domain architecture. Each of the 54 custom domains has a dedicated route that maps the domain to its designated origin group. This provides clear separation, easier debugging, and straightforward configuration management.

Standard Route Configuration

Route Name Pattern: [domain-name]-route
Example: drantechai-route

Route Settings:
├─ Patterns to match: www.drantech.ai/*
├─ Origin group: drantechai-backend
├─ Forwarding protocol: HTTPS only
├─ Query string caching: Ignore query string
├─ Dynamic compression: Enabled
└─ HTTPS redirect: Enabled (301 permanent redirect)

Key Route Mappings

Health Monitoring & Probes

Azure Front Door continuously monitors backend health to ensure traffic is only routed to healthy servers. Every 30 seconds, Front Door sends HTTP GET requests to the configured health probe path. Backends must respond with HTTP 200 OK within the timeout period to be considered healthy.

Standard Health Probe Configuration

Health Probe Settings (All Origin Groups):
├─ Path: /api/health
├─ Protocol: HTTP (not HTTPS)
├─ Method: GET or HEAD
├─ Interval: 30 seconds
├─ Timeout: 5 seconds
├─ Successful samples required: 2-3
└─ Unhealthy threshold: 2 consecutive failures

Why HTTP instead of HTTPS?
• Front Door terminates SSL at the edge
• Backend probes use internal Azure network (no SSL needed)
• Faster probe responses (no SSL handshake)
• Microsoft official recommendation for App Service origins

Flask Health Endpoint Implementation

@app.route("/api/health", methods=["GET", "HEAD"])
def api_health():
    """
    Front Door health probe endpoint.
    CRITICAL: Must always return 200 OK for Front Door to route traffic.
    - Do NOT add authentication
    - Do NOT add database checks
    - Do NOT add heavy logic
    - Must be fast (< 500ms)
    """
    return "OK", 200

Health Status Monitoring

# Check origin health status via Azure CLI
az afd origin show \
  --resource-group Corporate \
  --profile-name qi3ix-global-frontdoor \
  --origin-group-name drantechai-backend \
  --origin-name dranschak-east2-app \
  --query "healthProbeSettings"

# Expected response for healthy origin:
{
  "probePath": "/api/health",
  "probeProtocol": "Http",
  "probeRequestType": "GET",
  "probeIntervalInSeconds": 30
}

Deployment & Operations

Configuration Management Scripts

QI3IX maintains automated PowerShell scripts for Front Door configuration and auditing:

Post-Deployment Validation Checklist

• Verify all 54 custom domains are registered and associated with routes
• Confirm all origin groups have health probes enabled
• Check that all Flask apps return 200 OK from /api/health endpoint
• Test production domains resolve correctly (www.drantech.ai, www.celljourney.com, etc.)
• Verify holding page appears for strategic reserve domains
• Monitor Front Door metrics in Azure Portal (request count, latency, error rate)
• Confirm SSL certificates are valid and auto-renewing
• Validate HTTPS redirect is working (HTTP → HTTPS 301 redirect)

Common Troubleshooting Scenarios

Performance Optimization & Scaling

Global CDN Coverage

Azure Front Door operates from 100+ edge locations worldwide. When a user requests content, Front Door routes the request to the nearest edge location, significantly reducing latency. Static assets (images, CSS, JavaScript) are cached at the edge, reducing load on backend servers and improving response times.

Scaling Strategies

• Horizontal Scaling: Add more backend instances (App Service scale out)
• Geographic Distribution: Deploy backends to multiple Azure regions
• CDN Optimization: Maximize static asset caching at edge locations
• Origin Pooling: Multiple origins per origin group for load distribution

Security Architecture

SSL/TLS Management

Front Door manages SSL certificates for all 54 custom domains automatically. Certificates are provisioned via Azure's partnership with DigiCert and auto-renew before expiration. This eliminates manual certificate management overhead.

DDoS Protection

Azure Front Door Premium SKU includes Azure DDoS Protection Standard at no additional cost. This provides always-on traffic monitoring and automatic mitigation of common network-layer attacks (SYN floods, UDP floods, reflection attacks).

Web Application Firewall (WAF) - Future Enhancement

The Premium SKU supports Azure WAF for application-layer protection (SQL injection, XSS, etc.). This can be enabled in future phases as traffic patterns and security requirements evolve.

Cost Structure & Optimization

Pricing Components

Documentation & Resources

QI3IX Internal Documentation

Microsoft Azure Documentation

• Azure Front Door Official Documentation
• Health Probes in Azure Front Door
• Custom Domains and SSL Certificates
• Routing Architecture and Traffic Management