ADR-0001.1: Crawl — Static Documentation Site (MVP hosting)
a private, searchable docs site live this week for ~$10/mo — reusing existing auth, and the exact foundation the full platform grows from. The crawl phase of ADR-0001; where do we host it cheaply without painting us into a corner?
Context
We're committing only to the crawl: publish the current static content, private to Propel, and see if it earns expansion. Two things matter — cheap now, and a foundation the walk/run phases build on (not a re-platform later). Two existing assets to reuse rather than reinvent:
- A global Cognito OAuth2 IdP already lives in the security account (
propel-identity, sec1) as the "single identity source across all accounts." - Cloudflare already fronts our domain — so an org-wide Access policy over
*.propellabs.iois available to us.
Decision TBD
Suggested decision — not yet agreed, expand to review
Host on S3 + CloudFront; gate at the edge with Cloudflare Access over *.propellabs.io; reuse the existing Cognito IdP for application identity once the backend arrives. Stand up no new auth.
flowchart LR
U([Propel · ~12]) -->|SSO + MFA| ACC[Cloudflare Access
*.propellabs.io]
ACC -->|gated, origin-locked| CF[CloudFront + S3]
ACC -.Access JWT = identity.-> BE[backend later:
reuse Cognito IdP]
style ACC fill:#EDEDFF,stroke:#3B54F7
Auth is two composable layers (see the discussion above):
- Edge perimeter — Cloudflare Access on
*.propellabs.io. One zero-trust policy guards every internal tool; new tool = new subdomain, instantly protected. Managed-HA proxy mode, not acloudflaredtunnel, so it sidesteps the earlier tunnel-reliability worry. Lock CloudFront to accept only Cloudflare traffic (shared-secret header) so the origin URL can't be bypassed. - Application identity — reuse the existing Cognito IdP. For the static crawl, the Access JWT (carries the user's email) is enough — no Lambda@Edge/Cognito gate to build. When the backend arrives (comments/LLM), the API validates the Access JWT and/or the existing Cognito token for richer authZ.
Why host on AWS anyway: the walk/run phases (aggregation, comments, Bedrock LLM) are AWS, so hosting the crawl on S3 + CloudFront makes advancing additive, not a migration. Access sits in front of the AWS origin — best of both.
(Org-wide *.propellabs.io Access is bigger than docs — its own perimeter decision in ADR-0002, which this crawl rides on. If we don't adopt it, the fallback is a Cognito + Lambda@Edge gate on CloudFront.)
Options & cost (private, ~12 users)
| Option | Setup | $/mo | Maintenance | Grows to backend? |
|---|---|---|---|---|
| S3 + CloudFront, gated by Cloudflare Access ✅ | low (no Lambda@Edge — Access does the gate) | ~$5–15 | ~0 (static, managed) | ✅ same cloud — additive |
| Cloudflare Pages + Access | trivial | ~$0 | ~0 | ⚠️ different cloud — migrate later |
| S3 + CloudFront + Cognito Lambda@Edge | moderate (build the gate) | ~$5–15 | ~0 | ✅ fallback if we don't adopt org-wide Access |
| GitHub Pages (private) | trivial | +~$204 (needs Enterprise $21/user vs Team $4 × 12; $0 if already on GHE) | ~0 | ❌ static-only ceiling — never hosts comments/LLM |
| Confluence / Notion | trivial | ~$60–180 ($5–15/user) | ~0 | ❌ not dev-native |
| Self-host Docusaurus on ECS | heavy | ~$175+ | high (patching, HA) | ✅ but overkill now |
⚠️ GitHub Pages is the trap here: private (SSO-gated) Pages requires GitHub Enterprise — ~$204/mo more than Team for our ~12 users just to make docs private — and it's still static-only, so it can never host the run-phase backend. Only free if we're already on Enterprise for other reasons.
Consequences
Positive — cheap; near-zero maintenance (static + managed edge); no tunnel; no new auth (reuse Access + existing Cognito); the exact foundation Stack B extends; one identity from day one. Negative — depends on adopting Cloudflare Access org-wide (a broader decision); must origin-lock CloudFront to Cloudflare so the URL can't be bypassed. If we stall at crawl — totally fine: we're out ~$10/mo for a private, searchable docs site.
Alternatives not chosen
- Cloudflare Pages + Access — closest call; pick instead only to be live this week with near-zero setup, accepting a later migration to AWS.
- Cognito + Lambda@Edge gate — the fallback if we don't adopt org-wide
*.propellabs.ioAccess; more setup for the same result.
Discussion
Comments render here in the run phase. For now, #cloudops.