How to Build a CDN From Scratch Using VPS Nodes

┌─────────────┐     ┌──────────────┐     ┌─────────────────┐
│   User (EU)  │────▶│  GeoDNS      │────▶│  Edge Node EU   │
└─────────────┘     │  (Route 53 / │     │  (Amsterdam)    │
                    │   ClouDNS)   │     │  Nginx Cache    │──┐
┌─────────────┐     │              │     └─────────────────┘  │
│  User (US)   │────▶│              │────▶┌─────────────────┐  │  Cache
└─────────────┘     │              │     │  Edge Node US   │  │  MISS
                    │              │     │  (New York)     │──┤──────▶ Origin
┌─────────────┐     │              │     └─────────────────┘  │       Server
│  User (Asia) │────▶│              │────▶┌─────────────────┐  │
└─────────────┘     └──────────────┘     │  Edge Node Asia │  │
                                         │  (Singapore)    │──┘
                                         └─────────────────┘

Nginx origin config, /etc/nginx/sites-available/origin.conf

server {
    listen 80;
    server_name origin.yourdomain.com;
    root /var/www/html;

    # Static assets, cache aggressively (1 year)
    location ~* \.(css|js|jpg|jpeg|png|gif|webp|svg|woff2|woff|ico)$ {
        expires 365d;
        add_header Cache-Control "public, max-age=31536000, immutable";
        add_header X-Cache-Status "ORIGIN";
    }

    # HTML pages, cache briefly, revalidate
    location ~* \.html$ {
        expires 10m;
        add_header Cache-Control "public, max-age=600, must-revalidate";
        add_header X-Cache-Status "ORIGIN";
    }

    # API responses, don't cache
    location /api/ {
        add_header Cache-Control "no-store, no-cache";
        proxy_pass http://127.0.0.1:3000;
    }

    # Health check endpoint for edge nodes
    location /health {
        return 200 "OK";
        add_header Content-Type text/plain;
    }
}

Initial node setup script, run on each new VPS

#!/bin/bash
# Bootstrap CDN edge node (Ubuntu 22.04+)

# Update & install Nginx
apt update && apt upgrade -y
apt install -y nginx certbot python3-certbot-nginx ufw curl

# Create cache directories
mkdir -p /var/cache/nginx/cdn
chown -R www-data:www-data /var/cache/nginx

# Configure firewall
ufw allow 80/tcp
ufw allow 443/tcp
ufw allow 22/tcp
ufw --force enable

# Enable Nginx
systemctl enable nginx
systemctl start nginx

echo "Edge node ready, configure Nginx caching next"

Edge node Nginx config, /etc/nginx/sites-available/cdn-edge.conf

# Cache zone definition (in http block or separate conf)
proxy_cache_path /var/cache/nginx/cdn
    levels=1:2
    keys_zone=cdn_cache:100m      # 100MB for cache keys (~800K entries)
    max_size=10g                  # 10GB disk cache
    inactive=7d                   # Remove items not accessed in 7 days
    use_temp_path=off;

server {
    listen 80;
    server_name cdn.yourdomain.com;

    # Proxy to origin
    location / {
        proxy_pass http://ORIGIN_IP;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

        # Caching configuration
        proxy_cache cdn_cache;
        proxy_cache_valid 200 301 302 1d;    # Cache success for 1 day
        proxy_cache_valid 404 1m;            # Cache 404s briefly
        proxy_cache_use_stale error timeout updating
                              http_500 http_502 http_503 http_504;
        proxy_cache_lock on;                 # Prevent thundering herd
        proxy_cache_lock_timeout 5s;
        proxy_cache_revalidate on;           # Use If-Modified-Since

        # Cache key, include scheme for HTTPS/HTTP separation
        proxy_cache_key "$scheme$request_method$host$request_uri";

        # Add debug headers
        add_header X-Cache-Status $upstream_cache_status always;
        add_header X-Edge-Node "edge-us-east" always;
        add_header X-Cache-Key "$scheme$request_method$host$request_uri" always;
    }

    # Cache purge endpoint (restrict to your IPs)
    location /purge/ {
        allow ORIGIN_IP;
        deny all;
        proxy_cache_purge cdn_cache "$scheme$request_method$host$uri";
    }

    # Health check
    location /cdn-health {
        return 200 "edge-us-east:OK";
        add_header Content-Type text/plain;
    }
}

SSL setup per edge node

# Install Certbot and get certificate
certbot --nginx -d cdn.yourdomain.com --non-interactive --agree-tos -m admin@yourdomain.com

# Certbot auto-configures Nginx with:
# - SSL certificate and key paths
# - HTTP → HTTPS redirect
# - Modern TLS settings

# Verify auto-renewal
certbot renew --dry-run

# Add to crontab for auto-renewal (usually auto-added)
# 0 3 * * * certbot renew --quiet --post-hook "systemctl reload nginx"

# Optional: Stronger SSL config
# Add to Nginx server block:
ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers on;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;