ADR-0001: Centralized CloudFront Routing (fe-routing)
one CloudFront distribution, one WAF, one domain per environment — every frontend rides the same edge instead of four distributions with four certs and four WAF bills.
Context
Novamera runs multiple frontends (sim, datahub, borehole labelling, GPR dashboard). One distribution per frontend meant duplicated certs, WAF attachments, DNS records, and cache configs per app per env.
Decision
A single fe-routing stack per environment: one CloudFront distribution path-routes to each frontend's private S3 origin (/sim, /datahub, …) plus the API Gateway. WAF attaches once (prod). New frontend = a new origin + behavior, not a new distribution.
Consequences
Positive — one cert/WAF/domain per env; adding a frontend is config, not infrastructure; consistent auth at the edge (JWT via Lambda@Edge + JWKS cache). Negative — the distribution is a shared blast radius; a bad behavior change can affect all frontends; cache invalidations are coordinated.
Discussion
Customer-space ADR — decisions specific to Novamera live here, not in the internal log.