How to Set Up a Self-Hosted CDN: Step-by-Step Guide with OpenResty Edge

OpenResty is a well-known open-source web platform. OpenResty Edge is a separate commercial product — a production-ready private CDN and general gateway solution built for enterprise infrastructure teams.

Building your own CDN means solving four engineering problems in sequence: node placement, traffic routing, cache management, and security. This guide walks through each layer using OpenResty Edge as the implementation platform. If you’re still evaluating whether a private CDN is right for your organization, see our Enterprise Private CDN Solution overview first.

How OpenResty Edge Works: Edge Node, Admin, and Origin

A private CDN built on OpenResty Edge centers on three components. Edge Node gateway servers are deployed in geographic locations close to users; they terminate client connections, enforce caching and security policies, and serve cached content or fetch from upstream. The Admin management node is the control plane: it stores configuration, distributes policy updates to edge nodes, runs the monitoring dashboard, and hosts intelligent DNS scheduling. The origin server holds the authoritative content.

Data flow follows the request path: a user resolves DNS (often via the Admin node’s GSLB), hits the nearest edge node, and receives a cache hit or a proxied response from origin. Control flow runs in the opposite direction: operators define applications, cache rules, and security policies in the Admin console; changes propagate to edge nodes without manual per-node configuration. Health status and metrics flow back from edge nodes to Admin for monitoring and automated failover decisions.

User Request → DNS Resolution → Nearest Edge Node → Cache Hit/Origin Fetch → Content Return
                                ↓
                        Edge Admin Management Node (Configuration Distribution, Monitoring)

The sections below follow this architecture in setup order — from cluster initialization through DNS, caching, security, and operations.

What You’ll Need Before You Start

Recommended Hardware per Node

OpenResty Edge provides reference configurations to help technical teams implement node deployment:

Step 1 — Install OpenResty Edge and Initialize the Cluster

During system implementation, OpenResty Edge provides a clear, controllable, and automated deployment mechanism for building a private CDN network.

Installing the Admin Node

Provides detailed documentation and standardized processes. For detailed installation steps, please refer to: Installing OpenResty Edge

Registering and Onboarding Edge Nodes

• Supports one-click deployment and initialization through the console.
• Node registration and online process are transparent and easy to track.
• Offers deployment methods including physical machines, virtual machines, and Kubernetes, supporting large-scale Kubernetes cluster deployments and compatibility with mainstream infrastructure environments.

For detailed configuration steps, please refer to: Gateway Cluster

Kubernetes Deployment (Optional)

Supporting large-scale Kubernetes cluster deployments and compatibility with mainstream infrastructure environments.

Step 2 — Plan and Register Your Edge Nodes

1. Choosing Node Locations Based on User Distribution

• Intelligently plan node deployment based on user distribution, minimizing the physical distance between end-users and edge nodes, and reducing access latency.
• Evaluate deployment plans by combining bandwidth costs and network topology, optimizing operational costs while ensuring performance.

2. Scaling and Shrinking Nodes

• Support flexible node scaling and shrinking, reserve horizontal scaling space, and adapt to business peaks and global expansion needs.

Step 3 — Configure DNS and Traffic Routing

After deployment, integrate your business systems with the edge network:

• After creating an application and publishing the configuration in the console, the system will automatically distribute the configuration to the edge nodes.
• Add a CNAME record pointing to the OpenResty Edge domain in the DNS provider’s console.
• Supports unified management of multiple applications and domains, facilitating unified operation and maintenance across business lines.

1. Option A — Using Your Existing DNS Provider

• Use your own DNS service or a third-party service.
• Configure DNS records to resolve to OpenResty Edge nodes.

2. Option B — Using OpenResty Edge as Authoritative DNS

• Directly use OpenResty Edge as the authoritative DNS server.
• Manage all DNS records centrally.

For detailed configuration information, please refer to: DNS Configuration

Setting Up GSLB for Intelligent Traffic Scheduling

• Geo-location based scheduling: Directs users to the nearest edge node based on their geographical location.
• IP attribution scheduling: Optimizes routing paths based on the user’s ISP network.
• System load scheduling: Monitors edge node load in real-time and dynamically adjusts traffic distribution based on metrics like system load or QPS.

For detailed operational steps and information, please refer to the following documents:

1. Enabling DNS Global Server Load Balancing
2. DNS workflow

Configuring Automatic Failover and Health Checks

• Health Checks and Automatic Failover

For details on configuring DNS health checks, please refer to: DNS Health Checks

Step 4 — Set Up Caching Rules for High Hit Rates

Enabling Proxy Cache

If you want to improve the access efficiency of static resources or API responses, we recommend enabling the caching feature. For specific configuration methods, please refer to this document: Proxy Cache

Cache Rules by Content Type

Cache Configuration Dimensions

• Supports configuration dimensions such as path, method, and status code, helping businesses flexibly adjust caching strategies based on different business needs, ensuring efficient resource utilization.
• Custom caching rules allow businesses to optimize caching based on specific business logic and user behavior patterns, thereby improving user experience and system performance.
• Conditional caching and exclusion rule settings provide more granular control, ensuring the accuracy and effectiveness of caching strategies.

Cache Invalidation and Consistency

• API refresh interface provides a convenient cache management method, ensuring that businesses can quickly respond to content update needs and maintain a consistent user experience.
• Invalidation by path and tag supports large-scale content update scenarios, reducing the complexity of manual operations.
• Automatic origin fallback mechanism ensures that the latest content can be obtained in time when the cache expires, guaranteeing service continuity and reliability.

Extending Cache Logic with EdgeLang and Lua

• Leverage EdgeLang/Lua for dynamic control over caching logic, enabling personalized caching based on device, user, and other dimensions, enhancing user experience while optimizing resource utilization.

For detailed syntax and introduction, please see Edge Language User Manual.

Step 5 — Configure Edge Security Policies

OpenResty Edge provides a full-link security mechanism covering the transport layer to the application layer, supporting flexible policy configuration and refined management to meet compliance requirements and ensure business continuity and security boundary autonomy.

HTTPS Certificate Setup

Supports the complete certificate lifecycle management, enabling rapid deployment and continuous data transmission security. Suitable for enterprises looking to flexibly and uniformly manage HTTPS across multiple applications and domains.

• Automatic Let’s Encrypt Certificate Application: Supports domain validation and automatic renewal, reducing certificate maintenance burden.
• Import Custom Certificates: Supports enterprise-owned certificates, meeting higher security standards and customization requirements.
• Hot Certificate Renewal: Supports zero-downtime certificate replacement, ensuring service continuity.

IP Access Control

• Fine-grained configuration of IP whitelists and blacklists, page rules, and controlling the entry of risky traffic.
• Supports configuration cascading and granular authorization.

For details, please refer to the configuration documentation: Create IP List

DDoS Protection and Rate Limiting

• Automatic detection of high-concurrency attacks
• Supports dynamic rate limiting and traffic shaping policies for adaptive defense against abnormal traffic

For more information, please refer to the configuration documentation: Limit Traffic and Limit Rate

WAF Configuration

• Supports flexible rule writing to block specific attack behaviors
• Real-time threat monitoring and response mechanisms

For detailed configuration, please refer to the documentation: WAF

Edge Authentication (JWT, URL Signing, Custom Lua)

OpenResty Edge offers a variety of flexible edge authentication mechanisms to make access control more intelligent and closer to the user:

• JWT Verification: Supports standard token verification, compatible with third-party authentication systems
• URL Signature Mechanism: Prevents hotlinking and restricts unauthorized external access
• Time-Limited URL Support: Configures access time windows to ensure sensitive content is not exposed for extended periods
• Custom Lua Logic: Implements dynamic authentication based on business rules, reducing reliance on and pressure on the origin server

Step 6 — Monitor Your CDN and Set Up Alerting

After deploying a private CDN, the system’s stability, performance, and ability to quickly locate and repair faults become crucial for continuous operation.

Using the Built-in Real-Time Dashboard

To help technical teams grasp traffic dynamics and node status in real time, OpenResty Edge provides a visual monitoring dashboard.

• Key business indicators: traffic, response time, cache hit ratio, status code distribution, etc.
• Performance bottleneck discovery: abnormal responses, rising error rates, node load trends
• Real-time analysis capabilities: combines dynamic indicators with historical trends to support rapid decision-making and capacity forecasting

For detailed configuration, please refer to the documentation: Dynamic Metrics

Log Collection and External Integration

• OpenResty Edge automatically collects error logs, which, combined with dynamic metrics, satisfy most monitoring needs.
• Provides a complete access log collection mechanism, supporting auditing, traceback, and behavior analysis.

Integrating with Prometheus, Grafana, and ELK Stack

For more detailed log collection and analysis, different systems can be integrated to achieve more complex log analysis and alerting strategies:

• Collect OpenResty Edge Node access logs.
• Use tools like the ELK Stack for log analysis and alerting.

Configuration details can be found in: Monitoring OpenResty Edge

Performance Tuning After Go-Live

1. Cache Parameter Optimization: Adjust caching strategies based on monitoring information.
2. Network Optimization:
   • Enable HTTP/2 and HTTP/3 support.
   • Configure appropriate TCP parameters.
   • Use connection reuse to reduce handshake overhead.
3. Deep Analysis: Use OpenResty Xray for monitoring and analysis.

HTTP/3 configuration method can be found here: Enabling HTTP/3 Support

Failure Alerting Mechanism

Ways to implement failure alerting:

1. Utilize OpenResty Edge’s built-in alerting functionality.
2. Use Prometheus + Grafana for monitoring and alerting.

Configuration details can be found in: Monitoring OpenResty Edge

Database High Availability and Backup

Database High Availability Configuration: A highly available database configuration is crucial for ensuring system stability and data security. OpenResty Edge offers various deployment solutions for database clusters and master-slave architectures, allowing flexible selection based on specific business needs. Below are detailed setup guides:

• High-Availability Database Cluster Management Tool for OpenResty Edge
• Configuring OpenResty Edge Database High Availability Using Interactive Scripts

Data Backup: To ensure the security of configuration and management data, regular cold backups of the Edge Admin database are recommended. Detailed operational steps and precautions can be found in: OpenResty Edge Database Backup

Your self-hosted CDN is now live. If you need enterprise support or want to explore advanced configurations, contact the OpenResty Edge team.

FAQ

Q: How do I estimate the number of edge nodes required for deployment? A: We recommend planning based on user geographical distribution, anticipated concurrency, and latency requirements. Start with core regions and gradually expand as needed.

Q: Which operating systems and deployment methods are supported? A: We support mainstream Linux distributions. Deployment can be done via traditional installation, containerization (e.g., Docker), or Kubernetes.

Q: How does the edge computing capability support complex business scenarios? A: EdgeLang + Lua extensions enable the implementation of complex logic on edge nodes, such as authentication, A/B testing, personalized recommendations, and real-time data processing. This significantly reduces origin server requests and enhances user experience.

Related Documentation Links

• OpenResty Edge
• Installation and Upgrade
• Edge Admin User Manual
• OpenResty Edge™ Operations

What is OpenResty Edge

OpenResty Edge is our all-in-one gateway software for microservices and distributed traffic architectures. It combines traffic management, private CDN construction, API gateway, security, and more to help you easily build, manage, and protect modern applications. OpenResty Edge handles millions of concurrent connections per node on commodity hardware, with edge decisions executing in sub-millisecond latency via LuaJIT JIT compilation. It supports scheduling containerized application traffic such as K8s and manages massive domains, making it easy to meet the needs of large websites and complex applications.

About The Author

Yichun Zhang (Github handle: agentzh), is the original creator of the OpenResty^® open-source project and the CEO of OpenResty Inc..

Yichun is one of the earliest advocates and leaders of “open-source technology”. He worked at many internationally renowned tech companies, such as Cloudflare, Yahoo!. He is a pioneer of “edge computing”, “dynamic tracing” and “machine coding”, with over 22 years of programming and 16 years of open source experience. Yichun is well-known in the open-source space as the project leader of OpenResty^®, adopted by more than 40 million global website domains.

OpenResty Inc., the enterprise software start-up founded by Yichun in 2017, has customers from some of the biggest companies in the world. Its flagship product, OpenResty XRay, is a non-invasive profiling and troubleshooting tool that significantly enhances and utilizes dynamic tracing technology. And its OpenResty Edge product is a powerful distributed traffic management and private CDN software product.

As an avid open-source contributor, Yichun has contributed more than a million lines of code to numerous open-source projects, including Linux kernel, Nginx, LuaJIT, GDB, SystemTap, LLVM, Perl, etc. He has also authored more than 60 open-source software libraries.