Cloudflare-class protection answers a question civic platforms don't actually face. The threat shape is episodic harassment, not persistent commercial DDoS — angry mob spikes, scripted abuse waves, the occasional volumetric tantrum from someone who didn't like the post. The defense should match the threat. Always-on proxies tax every legitimate visitor to defend against attackers who show up for two hours a quarter. This cookbook is the alternative.
An always-on Cloudflare-class proxy is not a defense — it is a tax. It is paid by every legitimate neighbor on every page load to defend against attackers who, for civic platforms, represent a small fraction of traffic and arrive in concentrated bursts rather than continuous pressure. Three premises drive the architecture in this cookbook.
Every extra hop costs your users milliseconds. A proxy in Falkenstein routing traffic to an origin in Virginia adds 30ms to every request — a constant cost paid by readers to defend against bots they never see. Civic platforms are mostly read traffic. The math doesn't work.
A single proxy going down takes the whole platform with it. Mitigating that requires two proxies plus failover, which doubles the cost and operational surface. You're now maintaining a mini-CDN of your own — the very thing you were trying to avoid. The dependency moved; it didn't disappear.
The actual threat for most civic operators is bounded: an angry mob arrives, harasses for hours, leaves. The infrastructure to defeat that should match its shape — dormant by default, spun up when needed, torn down when the wave passes. That is achievable for less than a euro an hour.
You do not need a permanent fortress to weather an occasional storm. You need a roof that goes up in ninety seconds and comes down when the sky clears. The fortress is what was sold. The roof is what works.
The architecture separates three concerns that always-on WAF vendors bundle together — origin concealment, blocklist enforcement, and active filtering. Bundling them is what creates the SPOF and the latency tax. Separating them is what makes the cost collapse possible.
One-time platform config that makes direct-to-origin attacks impossible. Without this, every other layer can be bypassed by an attacker who finds the real IP.
Known-bad IPs and CIDR ranges dropped at the platform edge before they reach Node.js. Sentinel publishes the list; Fly or Hetzner enforce it. No proxy.
A scripted nginx proxy on a Hetzner CX22 that stands up in ninety seconds when an attack starts and tears down when it ends. DNS cutover via API. Pre-staged certs.
In-process Node.js middleware. Rate limiting, CIDR-range auto-escalation, UA fingerprinting, honeypot detection. The existing NetSentinel stack, hardened.
Layers 0, 1, and 3 run continuously and cost nothing. Layer 2 is dormant until an attack arrives, and exists only as a script and a DNS plan until then. The only sustained infrastructure is the application itself. Cloudflare's bundle is unbundled — and the bundle was the leverage.
Each recipe contains: a principle, the ingredient list, a sequence of steps, a representative code sample, and a Vibe Prompt — a copy-paste block formatted for Cursor, Claude Code, Replit, or any AI coding assistant that takes natural language and emits working code. The prompts are written to be self-contained.
Every other layer in this cookbook depends on this one. If an attacker can hit your application server's real IP directly, they bypass your null-routes, your bastion, and your middleware. Origin concealment closes that door — the application accepts traffic only from your platform's anycast layer or your bastion's IP. Anything else gets dropped at the network interface.
Most application-level attacks — credential stuffing, content scraping, scripted abuse — never trigger a honeypot path. They hit valid routes with high frequency or recognizable signatures. Three middleware layers close the gap: per-IP rate limiting, automatic CIDR-range escalation when a /24 keeps producing bad actors, and User-Agent fingerprinting against the small set of scanner tools that account for most automated probing.
Once Sentinel knows an IP is bad, the IP should not be reaching your application server at all — not just being told 403. Null-routing pushes the blocklist down to the platform's network layer, where blocked traffic is dropped before any Node.js worker thread sees it. Two paths: Fly.io's machine firewall API, or Hetzner Cloud Firewall. The pattern is identical: cron job reads the blocklist, generates a deny ruleset, applies via API. No proxy. No new infrastructure.
When the always-on layers are not enough — a sustained volumetric attack, an organized harassment campaign, anything that overwhelms in-process middleware — you stand up a proxy in front of the origin for the duration of the attack. The bastion is a CX22 with nginx, cloud-init, and the current sentinel blocklist. DNS cuts over to its IP. The origin firewall (Recipe 01) is updated to accept only from the bastion. When the wave passes, you tear it down. The whole cycle costs less than a euro.
DNS records that need to fail over must already be set to a 60-second TTL. If you discover the attack at 2 AM and your TTL is 3600 seconds, your fastest possible cutover is an hour. Set this on day one for every record that protects a public-facing service.
Let's Encrypt cold-start adds 30+ seconds and can fail under attack. Stage a wildcard cert in your secret store, encrypted, and have cloud-init drop it into nginx on first boot. The bastion is serving valid TLS within seconds, not minutes.
A single operator's blocklist is bounded by what their honeypots have seen. A federated blocklist — many operators sharing fingerprints under a covenant — is bounded by what the entire network has seen. This is the network effect Cloudflare uses to justify its pricing. The covenant version makes that effect available to everyone, with no central party who can decide who deserves protection. Each operator runs their own Sentinel instance. Each instance publishes a signed feed. Each instance subscribes to peers it trusts. Trust is established by covenant attestation, not by paid contract.
Not all peers are equally trusted. A new peer joins at trust 50 — their reports require corroboration from another peer before promoting an IP from the provisional pool to the active blocklist. Trust rises as their reports are corroborated by trusted peers and falls when their reports turn out to be false positives. The gradient prevents a single compromised or malicious peer from poisoning the entire network — the same mechanism by which a covenant community keeps faith without central enforcement.
If you'd rather not implement recipe-by-recipe, the prompt below is the cookbook compressed into a single instruction set. Drop it into Cursor or Claude Code with your repo open. It produces all five recipes as one cohesive PR. Verify each layer before going to production.
The cookbook does not specify a runtime for the bastion. Hetzner is the cheapest standing option in Europe, but the same cloud-init script runs on DigitalOcean, Vultr, Linode, or any cloud that accepts arbitrary user-data. Substitute the API client; the architecture holds.
Cloudflare's pricing is justified, in part, by their threat intelligence — every attack against any Cloudflare customer becomes data that protects every other customer. That is real value. The covenant question is whether that value should accrue to a single private entity or to the network of operators who produce it. Federation answers: to the network.
A single Sentinel instance only knows what its own honeypots have seen. A scanner that probes ten unrelated civic platforms gets caught ten times in isolation, with each operator independently figuring out it's bad.
Operators publish signed feeds. Other operators subscribe to peers they trust. The first hit at any peer becomes provisional intelligence. The second corroboration promotes it to active. The scanner gets caught at the first portal — not the tenth.
Trust is established by covenant attestation — a signed statement of operator identity and adherence — not by paying a vendor. A peer's trust score rises and falls based on the quality of their reports, not their bill. False positives cost trust. Corroborations earn it.
There is no central registry. There is no party that can revoke a peer, throttle a feed, or sell the intelligence to a state actor. Every operator runs their own instance, signs their own feed, and decides their own trust gradient. The protocol is open.
The network effect is the asset. The gate around the network is the leverage. Federation keeps the asset and removes the leverage. That is what was always supposed to be possible.
Always-on WAF vendors price for an availability scenario most civic operators don't actually live in. Below is the comparison at the size where most civic platforms operate — a few dozen domains, modest traffic, occasional harassment events. Numbers are illustrative; verify against current vendor pricing.
| Layer | Cloudflare-class always-on | Sovereign episodic stack |
|---|---|---|
| DNS | Bundled · gateway dependency | Bunny DNS · ~$0/mo |
| Always-on WAF / DDoS | $20–$200/mo per zone, more at scale | Express middleware · $0 |
| Origin concealment | Implicit · vendor-controlled | Fly/Hetzner firewall · $0 |
| Edge null-routing | Implicit · vendor-controlled | Sentinel sync · $0 |
| Standing infra cost | $240–$2,400+/yr | ~$0/yr |
| Per-attack cost | Bundled, but you cannot leave during one | ~€0.50/hr · CX22 pro-rated |
| Threat intelligence | Captive · sold back to you | Federated · covenant-governed |
| Off-switch leverage | Vendor holds the switch | You hold the switch |
The sovereign stack is not free in the sense of zero effort — implementing five recipes requires a developer afternoon (or a vibecoder hour) and operational discipline to maintain TTL settings and pre-staged certs. What it removes is the standing rent and the off-switch leverage. Those are the two things the always-on bundle was selling. They are now optional purchases — and most civic operators will never need to buy them.
This document is published under MIT license. The reference implementations are open source. The federation protocol is openly specified, implementable by anyone, in any language. There is no contributor agreement, no premium tier, no enterprise contact form. If you build it, you own it. If you improve it, contribute back if you wish, or don't. The point is not who gets credit. The point is that the gate is no longer the only path through.