Deployment planning
Cloudflare and Alibaba Cloud architectures.
Two separate options. Choose Cloudflare or Alibaba Cloud; they do not run together in these designs.
QueueRoom currently runs on Cloudflare. Alibaba is a proposed alternative, not an available QueueRoom backend. Costs below are infrastructure examples, not QueueRoom plan prices.
Architecture A
Cloudflare edge and Workers
Protection, application code and caching in one edge platform. Follow one request through the machine below.
Stop unwanted traffic first.
DDoS protection and WAF filter requests before application code runs.
The Worker handles the request.
It applies your application rules and decides whether it can use a saved response.
Reuse a public response when possible.
The Worker checks the cache. A hit avoids fresh data work, but the Worker has already run.
Pros
- Fewer services to connect and operate.
- Lower starting cost in the examples below.
Cons
- Existing application code may need changes to run in Workers.
- Plan limits and database location still affect cost and speed.
Technical routing and setup details
Cache branch: Application Worker → Cache API → public response on a hit. A miss or dynamic request continues to application data. Standard routed Workers run before cache lookup; a cache hit does not automatically remove the Worker invocation.
Before implementation
Use the protected custom hostname. Disable or protect alternate workers.dev and preview endpoints. Keep authentication, queue position, cart and personalized responses outside shared cache. Measure cold and warm behavior from target user locations.
Provider references: [1] Cloudflare website plans[2] Cloudflare Workers pricing[3] Cloudflare Workers and cache order[4] Cloudflare WAF[5] Cloudflare DDoS protection
Architecture B
Alibaba Cloud protection and Function Compute
Connect separate protection, caching and compute services. Cached requests can finish before application code runs.
Scrub attack traffic first.
Anti-DDoS Proxy is the entry point in this proposed fixed-path design.
A cache hit ends the journey early.
CDN returns a saved public response. It does not reach WAF or Function Compute.
Only misses need the application.
Dynamic requests and cache misses pass through WAF, then Function Compute and application data.
Pros
- Choose the region where your application runs.
- Useful when your application already uses Alibaba services.
Cons
- More services and security boundaries to configure.
- Separate protection fees and traffic limits need capacity planning.
Technical routing and setup details
Cache branch: CDN → public response on a hit, without reaching WAF or Function Compute. Misses and dynamic requests continue through WAF → Function Compute → application database or storage. WAF in this position does not inspect cache hits.
Why CDN appears before WAF
An alternative sequence, Anti-DDoS → WAF → CDN → function, places WAF before caching. Alibaba documents CDN → WAF for origin protection. The diagram uses that pattern. If every request must pass WAF before caching, validate that requirement and service topology with Alibaba rather than treating the two orders as interchangeable.
Alibaba also documents CDN and Anti-DDoS interaction that switches traffic to scrubbing during attacks. That is a different routing mode from the fixed entry path shown here.
Before implementation
Validate WAF-to-function custom-domain support, origin resolution, Host and TLS SNI with Alibaba before implementation. Prevent direct CDN, WAF and function endpoint bypass using supported origin authentication and access restrictions. An obscure hostname is not an access control.
Provider references: [6] Alibaba CDN and WAF integration[7] Alibaba Anti-DDoS and CDN interaction[8] Alibaba Function Compute origins for CDN[9] Alibaba Anti-DDoS Proxy pricing
For your customers
Arrive. Wait. Continue.
Open the protected page.
On your own Cloudflare zone, QueueRoom checks whether the visitor has signed admission.
Wait until the room admits you.
Without admission, the visitor sees the waiting page. The admission policy controls when they can continue.
Continue to your site.
A signed admission allows access. It does not reserve inventory or complete a purchase.
This shows QueueRoom on your own Cloudflare zone. The hosted script only queues browsers that run it; direct requests can skip it.
Monthly infrastructure costs
What would it cost each month?
See the additional cost for each provider separately. Exclude protection already paid for centrally, or include it to see the full modeled subtotal.
USD before tax, checked 26 October 2026. These are partial estimates for different protection plans, not equivalent security coverage or complete budgets.
Cloudflare only
Shared monthly charge deducted: $250.00. Deduct the bundled Business plan only if this domain is already covered. Cloudflare website plans are not automatically shared across every domain.
| Monthly cost breakdown | 1 million requests100 GB delivered | 10 million requests1,000 GB delivered | 100 million requests10,000 GB delivered |
|---|---|---|---|
| Business planDDoS protection, WAF and CDN bundle | $250.00 | $250.00 | $250.00 |
| Workers subscriptionMonthly account minimum | $5.00 | $5.00 | $5.00 |
| Worker requests10M included; $0.30/M extra | $0.00 | $0.00 | $27.00 |
| Worker CPU5 ms/request; 30M ms included; $0.02/M ms extra | $0.00 | $0.40 | $9.40 |
| DeliveryNo separate Workers egress fee modeled | $0.00 | $0.00 | $0.00 |
| Not priced | Data, admission authority, reporting, logs, support and tax — add measured usage or quotes. | ||
| Full modeled subtotal | $255.00 | $255.40 | $291.40 |
| Less existing protection | -$250.00 | -$250.00 | -$250.00 |
| Additional cost | $5.00 | $5.40 | $41.40 |
Alibaba Cloud only
Shared monthly charge deducted: $2,136.00. Deduct $1,580 Anti-DDoS + $556 WAF only if the existing subscriptions cover this domain and its required capacity.
| Monthly cost breakdown | 1 million requests100 GB delivered | 10 million requests1,000 GB delivered | 100 million requests10,000 GB delivered |
|---|---|---|---|
| Anti-DDoS InsuranceShared monthly subscription | $1,580.00 | $1,580.00 | $1,580.00 |
| WAF ProShared monthly subscription | $556.00 | $556.00 | $556.00 |
| CDN delivery100 / 1,000 / 10,000 GB × $0.081/GB | $8.10 | $81.00 | $810.00 |
| HTTPS requests$0.008 per 10,000 requests | $0.80 | $8.00 | $80.00 |
| Function Compute20% reach compute; $7.20/month minimum for 720 active hours | $7.20 | $7.20 | $37.00 |
| Not priced | Origin transfer, extra domains/capacity, burst or attack charges, data, logs, support and tax — add usage or quotes. | ||
| Full modeled subtotal | $2,152.10 | $2,232.20 | $3,063.00 |
| Less existing protection | -$2,136.00 | -$2,136.00 | -$2,136.00 |
| Additional cost | $16.10 | $96.20 | $927.00 |
Excluding protection allocates its entire subscription charge to your existing shared budget. The provider still bills that recurring fee; this is not a one-time purchase or a discount. Extra domain and capacity charges remain additional.
Still to add: data services, logs, QueueRoom’s admission and reporting resources, support and tax. Alibaba also needs origin transfer and peak-capacity charges. Get quotes for matching protection requirements before choosing.
Rates, assumptions and calculation details
One application domain, Malaysia delivery in Alibaba’s Asia-Pacific 1 region, steady traffic over 30 days. No trial credits, annual discounts or negotiated rates. QPS means requests per second; Mbps means megabits per second.
Cloudflare rate inputs
Business is $250/month when billed monthly. Workers Paid starts at $5/month, including 10 million requests and 30 million CPU milliseconds. Excess costs $0.30 per million requests and $0.02 per million CPU milliseconds. The model counts every request as a Worker invocation with 5 ms of CPU time, including cache hits. No separate Workers network-egress charge is modeled under the cited pricing. Other products and plan terms still apply. [1] [2]
Alibaba Cloud rate inputs
Anti-DDoS Insurance starts at $1,580/month with 50 Mbps clean bandwidth, 500 clean QPS and two advanced mitigation sessions per month. WAF Pro adds $556/month. CDN AP1 delivery is $0.081/GB in the first tier; static HTTPS requests cost $0.008 per 10,000 requests, conservatively applied to every modeled request. [9] [10] [11]
An 80% CDN hit ratio leaves 20% of requests invoking Function Compute. Each invocation assumes 0.35 vCPU, 0.5 GB memory, 200 ms duration, concurrency one, no warm minimum instances and free 512 MB disk. This converts to 0.0925 compute units at the first-tier reference rate of $0.000020 per unit. The model applies a $7.20 floor for one function active in all 720 hours. Actual hourly distribution and rounding can change charges. [12]
Calculation formulas
Let R be requests in millions, N be total requests and G be delivered GB.
The formulas below include protection. With “Exclude protection already paid for” enabled, subtract $250 for Cloudflare or $2,136 for Alibaba Cloud from that provider’s subtotal. Each toggle affects only its own option.
Cloudflare: $250 + $5 + max(0, R − 10) × $0.30 + max(0, 5R − 30) × $0.02.
Alibaba: $1,580 + $556 + G × $0.081 + N ÷ 10,000 × $0.008 + max($7.20, 0.2N × 0.0925 × $0.000020).
Function Compute units per invocation: 0.35 × 0.2 + 0.5 × 0.2 × 0.15 + 0.0075 = 0.0925. The hourly floor assumption applies to the steady, nonzero traffic scenarios in this table.
Costs still to add
Both subtotals exclude database and storage, logs, observability, support add-ons, tax, engineering and migration. For QueueRoom specifically, add admission authority, configuration, telemetry and reporting services such as Durable Objects, KV, Queues and R2 based on measured usage.
Alibaba also excludes Function Compute/CDT origin egress, bandwidth and QPS capacity uplifts, burst charges, extra mitigation sessions and WAF add-ons. Peak demand can exceed the minimum Anti-DDoS capacity even when monthly volume appears modest. Obtain a capacity quote before treating any subtotal as a budget.
What changes the result
Alibaba Unlimited starts at $4,210/month, adding $2,630 to the Insurance baseline before capacity differences; its minimum specification is 20 Mbps and 1,000 clean QPS. Removing the assumed cache hits multiplies modeled Function Compute invocations by five and increases origin traffic. Cloudflare CPU-heavy work raises Worker charges. Neither model covers a sustained attack bill. [9]
Choose an approach
Start with runtime fit and peak demand.
Consider Cloudflare when
The application fits Workers, users benefit from edge request handling, and reducing service configuration is a priority. QueueRoom’s existing Cloudflare connector is documented in the install guide.
Consider Alibaba Cloud when
Regional compute placement, function runtime needs or existing Alibaba integrations justify separate security services. Treat a QueueRoom port as a separate implementation project, with its own admission authority and security verification.
Validate before launch
- Record user locations, peak clean Mbps and QPS, dynamic request ratio, attack frequency and support requirements.
- Prove direct endpoints cannot bypass protection. Verify client-IP forwarding, TLS, tenant isolation and origin authentication.
- Keep personal and admission state outside shared cache. Test positive and negative WAF cases.
- Measure cold and warm latency, errors, cache hits, compute usage and origin transfer under representative peak load.
- Rehearse rollback and compare provider quotes for the same protection and capacity requirements.
Official provider references
Sources and verification limits.
Prices checked 26 October 2026. Provider purchase pages and contracts determine final charges. These diagrams describe proposed infrastructure; they do not certify an end-to-end integration, attack resistance, latency or production cost.
- Cloudflare website plans
- Cloudflare Workers pricing
- Cloudflare Workers and cache order
- Cloudflare WAF
- Cloudflare DDoS protection
- Alibaba CDN and WAF integration
- Alibaba Anti-DDoS and CDN interaction
- Alibaba Function Compute origins for CDN
- Alibaba Anti-DDoS Proxy pricing
- Alibaba WAF subscription pricing
- Alibaba CDN pricing
- Alibaba Function Compute billing