INFRASTRUCTURE DESIGN DOCUMENT
High-Availability Manga Platform Architecture
⚠️ DISCLAIMER
This document is a thought experiment and educational material only.
This infrastructure design is:
- Theoretical and unverified
- For educational purposes - To understand distributed systems, CDN architecture, and resilience patterns
- Not legal advice
- Not an endorsement - Of copyright infringement or illegal activities
The techniques described explore concepts in:
- Distributed systems architecture
- Geographic redundancy
- CDN optimization
- Security hardening
- Disaster recovery planning
EXECUTIVE SUMMARY
The system uses multiple domains, distributed servers, object storage (MinIO), and CDN delivery to create a platform that's fast, scalable, and resistant to takedowns.
Key Metrics:
- Storage Capacity: 30TB (10,000 manga titles)
- Expected Traffic: 1-10M visits/month
- Takedown Resistance: High (multi-domain, multi-IP)
- Geographic Distribution: 3+ countries
- CDN Providers: 3-5 (depending on tier)
PART 1: CORE ARCHITECTURE
1. SYSTEM OVERVIEW DIAGRAM
2. MULTI-DOMAIN STRATEGY
2.1 Domain Portfolio Structure
┌──────────────────────────────────────────────────────────────┐
│ DOMAIN HIERARCHY │
└──────────────────────────────────────────────────────────────┘
TIER 1: ACTIVE DOMAIN (Currently In Use)
┌─────────────────────────────────────────────────────────────┐
│ mangasite.ws │
│ Status: ACTIVE ✓ │
│ DNS: Cloudflare │
│ SSL: Let's Encrypt (Auto-renew) │
│ Indexed: Google, Bing │
│ Traffic: 100% of users │
└─────────────────────────────────────────────────────────────┘
TIER 2: HOT STANDBY (Ready to Activate Immediately)
┌─────────────────────────────────────────────────────────────┐
│ mangasite.sh - DNS configured, SSL ready │
│ mangasite.to - DNS configured, SSL ready │
│ 123manga.com - DNS configured, SSL ready │
│ mangasite.io - DNS configured, SSL ready │
│ │
│ Can activate in: 1-2 hours │
│ Cost: ~$15/year each │
└─────────────────────────────────────────────────────────────┘
TIER 3: COLD BACKUP (Registered, Parked)
┌─────────────────────────────────────────────────────────────┐
│ mangasite.ru - Registered, no DNS yet │
│ mangasite.net - Registered, no DNS yet │
│ mangaav.com - Registered, no DNS yet │
│ readmanga.to - Registered, no DNS yet │
│ + 6 more variations │
│ │
│ Can activate in: 4-8 hours │
│ Cost: ~$10/year each │
└─────────────────────────────────────────────────────────────┘
TOTAL INVESTMENT: $200-300/year for all domains
2.2 Domain Seizure Response Plan
TIMELINE: What Happens When Primary Domain Gets Seized
Hour 0: 🚨 SEIZURE DETECTED
├─ mangasite.ws suddenly redirects to seizure notice
├─ Monitoring alerts trigger
└─ Emergency response begins
Hour 1: ACTIVATE BACKUP DOMAIN
├─ Update DNS: mangasite.sh becomes new primary
├─ SSL certificate already configured (instant)
├─ Internal links updated automatically
└─ Backend detects domain change, updates URLs
Hour 2: COMMUNICATION BLITZ
├─ Post on X/Twitter: "New domain: mangasite.sh"
├─ Reddit announcement in relevant subs
├─ Discord/Telegram notifications
├─ Update bookmarks on aggregator sites
└─ Email notification to registered users (if any)
Hour 4-24: USER MIGRATION
├─ Most users find new domain via Google/social
├─ Old users bookmark new domain
├─ Traffic recovers to 80% of normal
└─ Search engines begin indexing new domain
Week 1: STABILIZATION
├─ 95% traffic recovered
├─ New domain fully indexed
├─ mangasite.ws = dead (abandoned)
└─ Next backup domain prepared
RESULT: 4-8 hours downtime maximum
Service continuity maintained
Minimal user loss
2.3 TLD Selection Strategy
RECOMMENDED DOMAIN PORTFOLIO:
Primary (User Trust):
┌──────────────────────────────────┐
│ .ws - Good SEO, hard to seize │
│ .to - Island nation, lenient │
│ .io - Tech-friendly │
└──────────────────────────────────┘
Note: .to domains may respond to US pressure (money-driven)
Backup (Seizure Resistant):
┌──────────────────────────────────┐
│ .ru - Russia (ignores US law) │
│ .sh - St. Helena (remote) │
│ .md - Moldova (lenient) │
└──────────────────────────────────┘
Avoid (Easy to Seize):
┌──────────────────────────────────┐
│ .com - US jurisdiction │
│ .net - US jurisdiction │
│ .org - US jurisdiction │
└──────────────────────────────────┘
USE STRATEGY: Start with .ws or .to
Keep .com as decoy
Backups in .ru, .sh, .md
3. SERVER DISTRIBUTION
3.1 Geographic Distribution Map
GLOBAL SERVER PLACEMENT
WHY THIS DISTRIBUTION:
- Russia: Close to Asia (largest manga market)
- Moldova: Central Europe (good for EU + US East)
- Iceland: Good for US West + Europe
- All offshore = DMCA resistance
3.2 Server Specifications
PER-SERVER CONFIGURATION
┌─────────────────────────────────────────────────┐
│ VPS SPECS (Each Server) │
├─────────────────────────────────────────────────┤
│ RAM: 8GB │
│ CPU: 4 cores │
│ Storage: 500GB SSD (OS + Database) │
│ Additional: 10TB HDD (MinIO storage) │
│ Bandwidth: Unmetered @ 1Gbps │
│ IP: 1 dedicated IPv4 │
│ Location: Russia/Moldova/Iceland │
│ Cost: $40-80/month each │
└─────────────────────────────────────────────────┘
SOFTWARE STACK (Each Server)
┌─────────────────────────────────────────────────┐
│ Docker: Container orchestration │
│ MinIO: Object storage (S3-compatible) │
│ PostgreSQL: Manga metadata database │
│ Redis: Caching layer │
│ Next.js: Frontend application │
│ Nginx: Reverse proxy │
└─────────────────────────────────────────────────┘
STORAGE ALLOCATION PER SERVER
┌─────────────────────────────────────────────────┐
│ Manga titles: 3,333 titles │
│ Average size: 3GB per title │
│ Total storage: ~10TB │
│ Compression: WebP format │
│ Retention: Permanent (no deletion) │
└─────────────────────────────────────────────────┘
3.3 Load Distribution Logic
HOW TRAFFIC IS ROUTED
METHOD 1: GEOGRAPHIC ROUTING (Recommended)
┌──────────────────────────────────────────────┐
│ │
│ User connects from: Tokyo, Japan │
│ ↓ │
│ GeoDNS detects: Asia region │
│ ↓ │
│ Returns IP: 5.6.7.8 (Russia server) │
│ ↓ │
│ User connects to nearest server │
│ Latency: 40ms (fast!) │
│ │
└──────────────────────────────────────────────┘
METHOD 2: ROUND ROBIN (Backup)
┌──────────────────────────────────────────────┐
│ │
│ Request 1 → Server 1 (Russia) │
│ Request 2 → Server 2 (Moldova) │
│ Request 3 → Server 3 (Iceland) │
│ Request 4 → Server 1 (Russia) │
│ ...cycles through all servers │
│ │
└──────────────────────────────────────────────┘
METHOD 3: HASH-BASED (For Specific Manga)
┌──────────────────────────────────────────────┐
│ │
│ Manga ID: "one-piece" │
│ ↓ │
│ Hash: hash("one-piece") % 3 = 1 │
│ ↓ │
│ Route to: Server 2 (Moldova) │
│ ↓ │
│ Always routes same manga to same server │
│ Consistent for caching │
│ │
└──────────────────────────────────────────────┘
4. STORAGE ARCHITECTURE (MinIO)
4.1 MinIO Deployment Model
STORAGE HIERARCHY
BENEFITS:
✓ No single point of failure
✓ Distributed storage load
✓ Geographic redundancy
✓ Each server fully independent
4.2 Bucket Structure
DETAILED FOLDER ORGANIZATION
4.3 Image Optimization Pipeline
UPLOAD PROCESS FLOW
5. CDN LAYER (BunnyCDN)
5.1 BunnyCDN Pull Zone Configuration
BUNNYCDN SETUP
┌────────────────────────────────────────────────────────┐
│ PULL ZONE CONFIGURATION │
├────────────────────────────────────────────────────────┤
│ Name: MangaSite-Images │
│ Type: Pull Zone (not push) │
│ Origin URL: https://minio.mangasite.ws:9000 │
│ Custom Domain: cdn.mangasite.ws │
│ │
│ CACHING │
│ ├─ Cache Expiry: 30 days (2592000 seconds) │
│ ├─ Browser Cache: 7 days │
│ ├─ Query String: Ignore (consistent caching) │
│ └─ Strip Cookies: Yes │
│ │
│ OPTIMIZATION │
│ ├─ WebP Optimization: Already optimized (skip) │
│ ├─ Compression: Brotli + Gzip │
│ ├─ Minification: N/A (images only) │
│ └─ HTTP/2: Enabled │
│ │
│ SECURITY │
│ ├─ SSL/TLS: Let's Encrypt (auto) │
│ ├─ Token Auth: Disabled (public content) │
│ ├─ Geo-Blocking: None │
│ └─ Hotlink Protect: Optional (your domains only) │
│ │
│ REGIONS (Enable All) │
│ ├─ Europe: $0.01/GB │
│ ├─ North America: $0.01/GB │
│ ├─ Asia/Oceania: $0.03/GB │
│ ├─ South America: $0.045/GB │
│ └─ Africa: $0.045/GB │
└────────────────────────────────────────────────────────┘
DNS CONFIGURATION:
cdn.mangasite.ws → CNAME → mangasite-images.b-cdn.net
5.2 Pull Zone Workflow
HOW PULL ZONE WORKS (First Request)
CACHE HIT RATE:
- First week: 60-70% (building cache)
- After month: 95%+ (most images cached)
- Result: 95% of requests never hit origin server
5.3 Cost Calculation
BANDWIDTH COST BREAKDOWN
SCENARIO: 1 Million Chapter Reads/Month
Per Chapter:
├─ 20 pages
├─ 200 KB per page (WebP)
└─ 4 MB per chapter
Total Traffic:
├─ 1M chapters × 4 MB = 4 TB
└─ + Overhead (thumbnails, metadata) = 5 TB total
BunnyCDN Cost:
├─ 5 TB @ $0.01/GB (US/EU) = $50
├─ Or mix: 3 TB US/EU + 2 TB Asia
│ └─ (3TB × $0.01) + (2TB × $0.03) = $90
└─ Total: $50-90/month
PART 2: SECURITY & PRIVACY
6. GEO-BLOCKING STRATEGY
Should you block Japan/Korea IPs?
YES - Strongly Recommended
BLOCK THESE COUNTRIES:
┌────────────────────────────────────────────┐
│ 🇯🇵 Japan - Publishers based here │
│ 🇰🇷 Korea - Webtoon companies here │
│ 🇺🇸 USA - DMCA lawsuits originate │
│ - (Optional - huge traffic) │
└────────────────────────────────────────────┘
WHY BLOCK JAPAN/KOREA:
┌────────────────────────────────────────────┐
│ Publishers monitor from these IPs │
│ Legal teams gather evidence │
│ Delays detection by 6-12 months │
│ Makes takedown notices harder │
└────────────────────────────────────────────┘
IMPLEMENTATION:
┌────────────────────────────────────────────┐
│ Method 1: Cloudflare Firewall Rules │
│ (Free tier - block by country) │
│ │
│ Method 2: Nginx GeoIP blocking │
│ (Server-level) │
│ │
│ Method 3: BunnyCDN geo-restrictions │
│ (CDN-level blocking) │
└────────────────────────────────────────────┘
VPN Detection
PROBLEM:
Japanese publisher uses VPN → appears as US IP → gets access
DETECTION METHODS:
- VPN IP Database
├─ Services: IPQualityScore, MaxMind
├─ Cost: $50-200/month
└─ Block known VPN/datacenter IPs - Behavioral Analysis
├─ Real users: erratic browsing
├─ Publishers: systematic scanning
└─ Block suspicious patterns - CAPTCHA for New IPs
├─ First visit from new IP → CAPTCHA
├─ Publishers script scrapers (fail CAPTCHA)
└─ Real users solve it once
VPN DETECTION TECHNIQUES
Basic Method: IP Geolocation
Advanced Method: IP Intelligence API
Behavioral Method:
├─ Real user: Browses multiple manga
├─ VPN + Publisher: Systematic scanning
│ └─ Checks 100 titles in 10 minutes
└─ Block pattern: Too fast = bot/scraper
7. ANONYMITY & PRIVACY
7.1 BunnyCDN Registration - How Anonymous Can You Be?
BUNNYCDN REGISTRATION REQUIREMENTS
WHAT THEY COLLECT:
┌────────────────────────────────────────────┐
│ Email address ← REQUIRED │
│ Payment method ← REQUIRED │
│ IP address (signup) ← AUTO-COLLECTED │
│ Name/Address ← OPTIONAL (for CC) │
└────────────────────────────────────────────┘
THEY STORE:
┌────────────────────────────────────────────┐
│ Your account details │
│ Origin server IPs (where they pull from) │
│ Traffic logs (30 days) │
│ Payment history │
└────────────────────────────────────────────┘
LEGAL EXPOSURE:
┌────────────────────────────────────────────┐
│ Publishers can subpoena BunnyCDN │
│ BunnyCDN will reveal: │
│ ├─ Email address used │
│ ├─ Payment method │
│ ├─ Origin server IPs │
│ └─ Traffic stats │
│ │
│ This leads them to YOUR servers │
└────────────────────────────────────────────┘
7.2 How to Maximize Anonymity
ANONYMITY STRATEGY FOR BUNNYCDN
- BURNER EMAIL
├─ Use: ProtonMail, Tutanota
├─ Accessed via VPN only
└─ Never linked to real identity - CRYPTOCURRENCY PAYMENT
├─ BunnyCDN accepts Bitcoin
├─ Use privacy coin mixer
├─ Create new wallet for each payment
└─ Never KYC exchange - REGISTER THROUGH VPN
├─ Use: Mullvad, IVPN (no logs)
├─ Never your home IP
└─ Different VPN each login - ORIGIN SERVER MASKING
├─ Don't point BunnyCDN directly to your VPS
├─ Use intermediary proxy/load balancer
└─ BunnyCDN sees proxy, not origin - PRIVACY-FOCUSED CDN ALTERNATIVES
├─ BunnyCDN - Good, accepts crypto
├─ KeyCDN - Similar, less KYC
└─ Self-hosted CDN - Most private but complex
7.3 What BunnyCDN Cannot See
WHAT BUNNYCDN DOESN'T KNOW
✓ Content of files (encrypted in transit)
✓ Your actual location (if using VPN)
✓ Your real identity (if using burner email + crypto)
✓ Your origin server (if using proxy layer)
✗ BUT they can see:
├─ Origin IP you configured (unless proxied)
├─ Domain names (cdn.yoursite.ws)
└─ Traffic patterns
7.4 Legal Risk Assessment
SUBPOENA SCENARIO
Good Opsec:
VS
Bad Opsec:
8. ORIGIN IP MASKING
Can you mask origin IP from BunnyCDN?
YES - Using Proxy Layer
ORIGIN IP MASKING ARCHITECTURE
WITHOUT PROXY (Bad):
WITH PROXY (Good):
9. ROUTING & IP TRACING DEFENSE
Can Publishers Find Origin IP?
TRACING METHODS
Method 1: DNS Lookup
Method 2: HTTP Headers
Method 3: SSL Certificate
Method 4: Direct Origin Access
Method 5: Historical DNS Records
10. FIREWALL CONFIGURATION
CRITICAL: Firewall Configuration
FIREWALL RULES (iptables)
ONLY ALLOW BUNNYCDN IPs:
RESULT:
- Only BunnyCDN can access your origin
- Direct access attempts fail
- Publishers can't bypass CDN
PART 3: ADVANCED FEATURES
11. MULTI-CDN ARCHITECTURE
11.1 The Strategy
SINGLE CDN (Basic - What most sites do):
┌─────────────────────────────────────────────┐
│ All traffic → BunnyCDN only │
│ │
│ RISK: BunnyCDN gets DMCA → entire site slow │
└─────────────────────────────────────────────┘
MULTI-CDN (Advanced - What MissAV does):
┌─────────────────────────────────────────────┐
│ Traffic distributed across: │
│ ├─ 40% → BunnyCDN │
│ ├─ 30% → Cloudflare │
│ ├─ 20% → Custom edge servers │
│ └─ 10% → KeyCDN (backup) │
│ │
│ BENEFIT: One gets DMCA → traffic shifts │
│ No single point of failure │
└─────────────────────────────────────────────┘
11.2 Multi-CDN Implementation
Architecture Diagram
11.3 Setup Multiple CDN Providers
PROVIDER SETUP
Provider 1: BunnyCDN
┌─────────────────────────────────────────────┐
│ Pull Zone: manga-bunny │
│ Origin: https://origin.site.internal:9000 │
│ Custom Domain: cdn1.mangasite.ws │
│ Cost: $0.01/GB │
│ Purpose: Primary image delivery │
└─────────────────────────────────────────────┘
Provider 2: Cloudflare (Pro Plan)
┌─────────────────────────────────────────────┐
│ Domain: cdn2.mangasite.ws │
│ Origin: https://origin.site.internal:9000 │
│ Page Rules: Cache Everything │
│ Cost: $20/month + bandwidth │
│ Purpose: DDoS protection + caching │
└─────────────────────────────────────────────┘
Provider 3: KeyCDN (Backup)
┌─────────────────────────────────────────────┐
│ Pull Zone: manga-key │
│ Origin: https://origin.site.internal:9000 │
│ Custom Domain: cdn3.mangasite.ws │
│ Cost: $0.04/GB (more expensive) │
│ Purpose: Failover when others down │
└─────────────────────────────────────────────┘
Provider 4: Custom Edge Servers (DIY CDN)
┌─────────────────────────────────────────────┐
│ VPS 1: Tokyo (cdn-asia.site.ws) │
│ VPS 2: London (cdn-eu.site.ws) │
│ VPS 3: New York (cdn-us.site.ws) │
│ Cost: $15/month × 3 = $45/month │
│ Purpose: Full control, DMCA-resistant │
└─────────────────────────────────────────────┘
12. DNS-BASED LOAD BALANCING
Method A: Cloudflare Load Balancing
CLOUDFLARE DASHBOARD SETUP
Traffic → Load Balancer → Distributes to CDNs
Load Balancer Configuration:
┌─────────────────────────────────────────────┐
│ Hostname: cdn.mangasite.ws │
│ │
│ Origin Pools: │
│ │
│ Pool 1: BunnyCDN (Weight: 40) │
│ └─ cdn1.mangasite.ws │
│ │
│ Pool 2: Cloudflare R2 (Weight: 30) │
│ └─ cdn2.mangasite.ws │
│ │
│ Pool 3: KeyCDN (Weight: 20) │
│ └─ cdn3.mangasite.ws │
│ │
│ Pool 4: Custom Servers (Weight: 10) │
│ └─ cdn-asia.site.ws (Asia users) │
│ └─ cdn-eu.site.ws (EU users) │
│ └─ cdn-us.site.ws (US users) │
│ │
│ Health Checks: Every 30 seconds │
│ Failover: Automatic if pool down │
└─────────────────────────────────────────────┘
DNS Response Example:
COST: $5/month (Cloudflare Load Balancer)
Method B: GeoDNS with NS1 or Route53
GEOGRAPHIC ROUTING
NS1 Configuration:
┌─────────────────────────────────────────────┐
│ Record: cdn.mangasite.ws │
│ │
│ Asia Traffic (JP, KR, CN, etc.): │
│ └─ cdn-asia.site.ws (Tokyo VPS) │
│ │
│ Europe Traffic (UK, DE, FR, etc.): │
│ └─ cdn-eu.site.ws (London VPS) │
│ │
│ Americas (US, CA, MX, BR, etc.): │
│ └─ cdn-us.site.ws (NYC VPS) │
│ │
│ Fallback (Rest of World): │
│ └─ cdn1.mangasite.ws (BunnyCDN) │
└─────────────────────────────────────────────┘
COST: $8-30/month (NS1 or Route53)
13. CUSTOM DOMAIN MASKING
Why Masking Matters
WITHOUT MASKING:
WITH MASKING:
Setup Custom Domains per CDN
DNS CONFIGURATION
BunnyCDN:
┌─────────────────────────────────────────────┐
│ cdn1.mangasite.ws CNAME mangasite.b-cdn.net │
│ │
│ User sees: cdn1.mangasite.ws │
│ Behind: BunnyCDN infrastructure │
└─────────────────────────────────────────────┘
Cloudflare:
┌─────────────────────────────────────────────┐
│ cdn2.mangasite.ws A 104.21.x.x (CF IP) │
│ │
│ User sees: cdn2.mangasite.ws │
│ Behind: Cloudflare R2 + CDN │
└─────────────────────────────────────────────┘
KeyCDN:
┌─────────────────────────────────────────────┐
│ cdn3.mangasite.ws CNAME mangasite.kxcdn.com │
│ │
│ User sees: cdn3.mangasite.ws │
│ Behind: KeyCDN infrastructure │
└─────────────────────────────────────────────┘
Custom Servers:
┌─────────────────────────────────────────────┐
│ cdn-asia.site.ws A 45.76.x.x (Tokyo VPS) │
│ cdn-eu.site.ws A 91.92.x.x (London) │
│ cdn-us.site.ws A 23.94.x.x (NYC) │
│ │
│ User sees: Your custom domains │
│ Behind: Your VPS servers │
└─────────────────────────────────────────────┘
RESULT:
All URLs look like "your" domain
CDN providers hidden from casual inspection
14. MULTIPLE PROXY LAYERS
The Onion Architecture
LAYERED PROXY APPROACH
Layer 1: Public-Facing CDNs
┌─────────────────────────────────────────────┐
│ cdn1.mangasite.ws (BunnyCDN) │
│ cdn2.mangasite.ws (Cloudflare) │
└──────────────┬──────────────────────────────┘
↓ pulls from
Layer 2: Proxy Tier (Shields Origin)
┌─────────────────────────────────────────────┐
│ proxy1.internal (Russia) │
│ proxy2.internal (Moldova) │
└──────────────┬──────────────────────────────┘
↓ forwards to
Layer 3: Origin Servers (Hidden)
┌─────────────────────────────────────────────┐
│ origin1.internal (MinIO storage) │
│ origin2.internal (MinIO replica) │
└─────────────────────────────────────────────┘
BENEFIT:
- CDN providers only know proxy IPs
- Proxy layer in bulletproof hosting
- Origin servers completely hidden
- Can rotate proxies without changing CDNs
15. ROTATING INFRASTRUCTURE
Weekly Rotation Schedule
ROTATION STRATEGY
Week 1-4: Configuration A
┌─────────────────────────────────────────────┐
│ Primary: BunnyCDN (cdn1.site.ws) │
│ Secondary: Cloudflare (cdn2.site.ws) │
│ Backup: KeyCDN (cdn3.site.ws) │
│ Proxy: proxy1.ru (Russia) │
└─────────────────────────────────────────────┘
Week 5: ROTATION EVENT
├─ Deploy new proxy: proxy2.md (Moldova)
├─ Update CDN origins to point to proxy2
├─ DNS TTL set to 300 seconds (5 min)
└─ Gradual traffic shift over 24 hours
Week 5-8: Configuration B
┌─────────────────────────────────────────────┐
│ Primary: Cloudflare (cdn2.site.ws) │
│ Secondary: KeyCDN (cdn3.site.ws) │
│ Backup: BunnyCDN (cdn1.site.ws) │
│ Proxy: proxy2.md (Moldova) │
└─────────────────────────────────────────────┘
Week 9: ROTATION EVENT
├─ Retire proxy1, deploy proxy3
├─ Shift primary to KeyCDN
└─ Continue rotation...
BENEFITS:
- Publishers can't pin down infrastructure
- DMCA notices target old config (already changed)
- Continuous service with no downtime
16. OBSCURATION TECHNIQUES
Technique 1: Random URL Patterns
Technique 2: Time-Limited Signed URLs
Technique 3: Domain Fronting (Advanced)
DOMAIN FRONTING TECHNIQUE
Use major CDNs' infrastructure to hide real destination:
Setup (Cloudflare Workers):
COST: $5/month (Cloudflare Workers)
BENEFIT: Real origin completely hidden
17. PWA OFFLINE READING
PWA Architecture Diagram
PWA OFFLINE READING FLOW
First Visit (Online):
Later (Offline):
When Back Online:
PART 4: OPERATIONS
18. MONITORING & ALERTING SYSTEM
What to Monitor
MONITORING DASHBOARD
CDN Health:
┌─────────────────────────────────────────────┐
│ BunnyCDN: ✓ Online | 45% traffic │
│ Cloudflare: ✓ Online | 35% traffic │
│ KeyCDN: ✓ Standby | 0% traffic │
│ Custom Asia: ✓ Online | 15% traffic │
│ Custom EU: ✓ Online | 5% traffic │
└─────────────────────────────────────────────┘
Proxy Layer:
┌─────────────────────────────────────────────┐
│ proxy1.ru: ✓ Active | 2ms latency │
│ proxy2.md: ✓ Standby | Ready │
│ proxy3.is: ⚠ Maintenance │
└─────────────────────────────────────────────┘
Origin Servers:
┌─────────────────────────────────────────────┐
│ origin1: ✓ Online | CPU: 45% │
│ origin2: ✓ Online | CPU: 38% │
│ MinIO: ✓ Healthy | Storage: 8.2TB │
│ PostgreSQL: ✓ Healthy | Connections: 45 │
└─────────────────────────────────────────────┘
Security Alerts:
┌─────────────────────────────────────────────┐
│ ⚠ 15 Japan IPs blocked (last hour) │
│ ⚠ Honeypot accessed 3 times (investigating) │
│ ✓ No unusual traffic patterns │
│ ✓ All SSL certs valid │
└─────────────────────────────────────────────┘
Traffic Stats (24h):
┌─────────────────────────────────────────────┐
│ Total Requests: 2.5M │
│ Bandwidth: 850 GB │
│ Cache Hit Rate: 94% │
│ Avg Response Time: 45ms │
│ Error Rate: 0.02% │
└─────────────────────────────────────────────┘
19. EMERGENCY FAILOVER PROCEDURES
Scenario 1: Primary CDN Gets DMCA
DMCA NOTICE RECEIVED BY BUNNYCDN
Hour 0: BunnyCDN sends notice
↓
Auto-detection: Monitoring sees 403 errors
↓
AUTOMATED RESPONSE:
┌─────────────────────────────────────────────┐
│ 1. Traffic routing updated (30 seconds): │
│ - BunnyCDN: 45% → 0% │
│ - Cloudflare: 35% → 60% │
│ - Custom servers: 20% → 40% │
│ │
│ 2. DNS updated (5 minutes): │
│ - cdn1.site.ws removed from rotation │
│ - cdn2.site.ws becomes primary │
│ │
│ 3. Users see no disruption │
│ - Automatic client-side failover │
│ - <1 second retry on failed images │
│ │
│ 4. Operator notified via Telegram │
│ │
│ 5. Backup CDN (KeyCDN) activated │
│ - Begin warming cache │
│ - Ready to take traffic in 1 hour │
└─────────────────────────────────────────────┘
Hour 1-24: Investigation & Response
├─ Review DMCA notice details
├─ Determine if BunnyCDN temporary or permanent
├─ If permanent: Shift to KeyCDN permanently
├─ If temporary: Wait for resolution
└─ Document incident for future prevention
Result: <5 minutes downtime, transparent to users
Scenario 2: Origin Server Compromised
ORIGIN SERVER BREACH DETECTED
Detection: Unusual access patterns logged
↓
MANUAL RESPONSE (within 1 hour):
┌─────────────────────────────────────────────┐
│ 1. Isolate compromised server immediately │
│ - Disconnect from network │
│ - Block all inbound connections │
│ │
│ 2. Activate replica origin │
│ - origin2.internal becomes primary │
│ - Update proxy configurations │
│ - CDNs continue pulling from proxy │
│ │
│ 3. Forensic analysis │
│ - Review access logs │
│ - Identify breach vector │
│ - Check for data exfiltration │
│ │
│ 4. Deploy fresh origin server │
│ - New VPS, different provider │
│ - Restore from clean backup │
│ - Enhanced security measures │
│ │
│ 5. Gradual traffic shift │
│ - origin2 → new origin3 │
│ - Monitor for issues │
│ - Retire compromised server │
└─────────────────────────────────────────────┘
Result: Service continues, breach contained
Scenario 3: Mass Takedown (Multiple Components)
COORDINATED ATTACK: Multiple Services Hit
Simultaneous:
├─ BunnyCDN: DMCA takedown
├─ Cloudflare: Abuse complaint
├─ Domain: Registrar seizure notice
└─ Proxy: DDoS attack
EMERGENCY PROTOCOL:
┌─────────────────────────────────────────────┐
│ 1. Activate ALL backups simultaneously │
│ - Switch to KeyCDN + custom servers │
│ - Activate backup domain (.sh) │
│ - Rotate to standby proxy │
│ - Deploy emergency proxy if needed │
│
│
│ 2. Communication (within 30 minutes) │
│ - Post on X/Twitter: "New domain: .sh" │
│ - Update Reddit/Discord communities │
│ - Push notification via PWA │
│ │
│ 3. Infrastructure rebuild (24-48 hours) │
│ - New CDN accounts (different email) │
│ - New domain registrations │
│ - Fresh proxy servers │
│ - Enhanced security audit │
│ │
│ 4. Traffic recovery (1 week) │
│ - 80% users find new domain Day 1 │
│ - 95% recovered by Day 7 │
│ - Search engines re-index │
└─────────────────────────────────────────────┘
Downtime: 2-6 hours
Recovery: 90% within 24 hours
20. DETECTION DIFFICULTY COMPARISON
How Hard to Trace Your Infrastructure
SINGLE CDN (Easy):
MULTI-CDN + MASKING (Hard):
MULTI-CDN + ROTATION + OBSCURATION (Very Hard):
├─ Weekly rotation of primary CDN
├─ Monthly rotation of proxy infrastructure
├─ Domain fronting via major providers
├─ Encrypted origin server addresses
├─ Traffic distributed across 50+ IPs
├─ No consistent patterns in URLs
├─ Multiple legal jurisdictions involved
├─ Payment trails completely anonymized (crypto)
├─ Registration details compartmentalized
└─ Real operators identity unknown
Time to fully identify: Months/Years (if ever) ✓✓✓
PUBLISHER'S INVESTIGATION REPORT:
PART 5: IMPLEMENTATION GUIDE
21. REAL-WORLD IMPLEMENTATION GUIDE
Phase 1: Foundation (Month 1)
START SIMPLE, SCALE UP
Week 1-2: Single CDN Setup
┌─────────────────────────────────────────────┐
│ 1. Deploy MinIO on Russia VPS │
│ 2. Setup BunnyCDN pull zone │
│ 3. Configure custom domain (cdn1.site.ws) │
│ 4. Upload test manga │
│ 5. Test end-to-end delivery │
│ │
│ Cost: $50/month │
│ Complexity: Low │
│ Takedown Risk: Medium │
└─────────────────────────────────────────────┘
Week 3-4: Add Proxy Layer
┌─────────────────────────────────────────────┐
│ 1. Deploy proxy VPS (Moldova) │
│ 2. Configure Nginx reverse proxy │
│ 3. Point BunnyCDN to proxy (not origin) │
│ 4. Firewall: Only proxy can access origin │
│ 5. Test failover │
│ │
│ Cost: $70/month │
│ Complexity: Medium │
│ Takedown Risk: Low-Medium │
└─────────────────────────────────────────────┘
Phase 2: Redundancy (Month 2-3)
ADD MULTIPLE CDNS
Month 2: Second CDN Provider
┌─────────────────────────────────────────────┐
│ 1. Setup Cloudflare pull zone │
│ 2. Configure custom domain (cdn2.site.ws) │
│ 3. Point to same proxy as BunnyCDN │
│ 4. Implement app-level load balancing │
│ - 50% traffic to BunnyCDN │
│ - 50% traffic to Cloudflare │
│ 5. Monitor performance of both │
│ │
│ Cost: $120/month │
│ Complexity: Medium │
│ Takedown Risk: Low │
└─────────────────────────────────────────────┘
Month 3: Add Backup CDN + Custom Servers
┌─────────────────────────────────────────────┐
│ 1. Setup KeyCDN (backup, inactive) │
│ 2. Deploy 2 edge VPS servers: │
│ - Tokyo (for Asia traffic) │
│ - London (for EU traffic) │
│ 3. Configure GeoDNS routing │
│ 4. Implement automatic failover │
│ │
│ Cost: $200/month │
│ Complexity: High │
│ Takedown Risk: Very Low │
└─────────────────────────────────────────────┘
Phase 3: Advanced Obscuration (Month 4+)
STEALTH MODE
Month 4: URL Obfuscation
┌─────────────────────────────────────────────┐
│ 1. Implement hashed URL paths │
│ 2. Add signed URLs with expiration │
│ 3. Deploy decoy endpoints │
│ 4. Setup IP logging for honeypots │
│ 5. Randomize CDN selection per user │
└─────────────────────────────────────────────┘
Month 5: Automated Rotation
┌─────────────────────────────────────────────┐
│ 1. Setup automated CDN weight rotation │
│ 2. Deploy 2nd proxy server (standby) │
│ 3. Implement monthly proxy rotation │
│ 4. Create rotation monitoring dashboard │
│ 5. Test emergency failover procedures │
└─────────────────────────────────────────────┘
Month 6: Full Stealth Mode
┌─────────────────────────────────────────────┐
│ 1. Add domain fronting (Cloudflare Workers) │
│ 2. Deploy 2 more edge servers (5 total) │
│ 3. Implement 4th CDN provider │
│ 4. Setup VPN detection + geo-blocking │
│ 5. Enable Japan/Korea IP blocking │
│ 6. Full monitoring + alerting │
│ │
│ Cost: $350-400/month │
│ Complexity: Very High │
│ Takedown Risk: Extremely Low │
│ Detection Difficulty: Months-Years │
└─────────────────────────────────────────────┘
22. MULTI-CDN COST BREAKDOWN
MONTHLY COSTS
CDN Providers:
├─ BunnyCDN: $100 (10TB @ $0.01/GB)
├─ Cloudflare Pro: $20/month base
├─ KeyCDN: $0 (standby, pay per use)
└─ Subtotal: $120/month
Custom Edge Servers (DIY CDN):
├─ Tokyo VPS: $15/month
├─ London VPS: $15/month
├─ NYC VPS: $15/month
└─ Subtotal: $45/month
Proxy Layer:
├─ Active Proxy (Russia): $20/month
├─ Standby Proxy (Moldova): $10/month
└─ Subtotal: $30/month
DNS & Load Balancing:
├─ Cloudflare Load Balancer: $5/month
├─ GeoDNS (NS1): $30/month
└─ Subtotal: $35/month
Monitoring:
├─ Uptime monitoring: $10/month
├─ Log analysis: $10/month
└─ Subtotal: $20/month
──────────────────────────
TOTAL: ~$250-300/month
TRAFFIC SUPPORTED: 10-30 TB/month
EXPECTED USERS: 1-5M visits/month
REDUNDANCY: High (no single point of failure)
23. IMPLEMENTATION CHECKLIST
✅ MULTI-CDN IMPLEMENTATION CHECKLIST
□ PRIMARY CDN (BunnyCDN)
□ Account created with burner email + crypto
□ Pull zone configured
□ Custom domain added (cdn1.site.ws)
□ SSL certificate auto-generated
□ Points to proxy layer (not direct origin)
□ Cache settings: 30 days
□ SECONDARY CDN (Cloudflare)
□ Pro plan activated ($20/month)
□ Page rules for cache everything
□ Custom domain (cdn2.site.ws)
□ Points to proxy layer
□ Rate limiting configured
□ BACKUP CDN (KeyCDN)
□ Account on standby
□ Pull zone pre-configured
□ Custom domain ready (cdn3.site.ws)
□ Can activate within 1 hour
□ CUSTOM EDGE SERVERS
□ VPS #1 deployed (Tokyo)
□ VPS #2 deployed (London)
□ Nginx reverse proxy configured
□ Cache storage allocated (50GB each)
□ Firewall rules (only CDN IPs)
□ PROXY LAYER
□ Active proxy (Russia) operational
□ Standby proxy (Moldova) ready
□ Firewall: Only CDN IPs allowed
□ Nginx configured for caching
□ Health monitoring enabled
□ LOAD BALANCING
□ Cloudflare Load Balancer configured
□ GeoDNS routing setup
□ Health checks every 30 seconds
□ Automatic failover tested
□ Traffic distribution verified
□ DOMAIN STRATEGY
□ Primary domain active
□ 5 hot standby domains configured
□ 10 cold backup domains registered
□ DNS TTL set to 300 seconds
□ All domains use WHOIS privacy
□ OBSCURATION
□ Custom domains mask CDN providers
□ URL obfuscation implemented (optional)
□ Signed URLs with expiration (optional)
□ Decoy endpoints deployed (optional)
□ Honeypot logging active
□ SECURITY
□ Japan/Korea IP blocking enabled
□ VPN detection configured
□ Rate limiting per IP
□ CAPTCHA for suspicious traffic
□ Firewall rules verified
□ MONITORING
□ CDN health checks (5 min)
□ Origin server monitoring
□ Proxy server monitoring
□ Telegram alerts configured
□ Log aggregation setup
□ AUTOMATION
□ Weekly CDN rotation script
□ Monthly proxy rotation script
□ Automatic failover tested
□ Emergency procedures documented
□ DOCUMENTATION
□ Infrastructure diagram created
□ Access credentials secured (password manager)
□ Runbook for common issues
□ Emergency contact list
□ Rotation schedule documented
PART 6: COST-BENEFIT ANALYSIS
24. DEPLOYMENT TIERS
TIER 1: BASIC ($150/month)
├─ 1 CDN (BunnyCDN)
├─ 1 Proxy server
├─ 5 backup domains
├─ Basic monitoring
├─ Setup time: 1 week
├─ Takedown risk: Medium
└─ Good for: Starting out, testing waters
TIER 2: STANDARD ($300/month)
├─ 3 CDN providers
├─ 2 Proxy servers (rotating)
├─ 10 backup domains
├─ Geo-blocking (JP/KR)
├─ Automated failover
├─ Setup time: 1 month
├─ Takedown risk: Low
└─ Good for: Serious operation, 1-5M visits
TIER 3: ADVANCED ($600/month)
├─ 5+ CDN providers
├─ 5 Proxy servers (mesh)
├─ 20+ backup domains
├─ VPN detection
├─ URL obfuscation
├─ AI routing
├─ Honeypot network
├─ Setup time: 3 months
├─ Takedown risk: Very Low
└─ Good for: 5-20M visits, high-profile
TIER 4: PARANOID ($1500/month)
├─ 10+ CDN providers
├─ 15+ Proxy servers (3 layers)
├─ 50+ rotating domains
├─ Blockchain domains (.crypto, .eth)
├─ P2P distribution (WebTorrent)
├─ Domain fronting (Cloudflare Workers)
├─ AI-powered routing
├─ Advanced VPN/proxy detection
├─ Honeypot network (10+ decoys)
├─ Signed URLs with rotation
├─ 24/7 monitoring + auto-response
├─ Weekly infrastructure rotation
├─ Multi-jurisdiction setup (5+ countries)
├─ Encrypted operator communications
├─ Cold wallet crypto payments only
├─ Zero-knowledge architecture
├─ Setup time: 6 months
├─ Maintenance: 10-20 hours/week (or hire team)
├─ Takedown risk: <0.1%
├─ Detection difficulty: Months/Years
└─ Good for: 20M+ visits, maximum paranoia
25. RECOMMENDED VPS PROVIDERS
Best Value:
Hetzner Storage Box + VPS Combo
├─ VPS: 8GB RAM, 4 CPU = €20/mo
├─ Storage Box: 10TB = €30/mo
└─ Total: €50/mo (~$55/mo)
Location: Germany (good for EU, acceptable for DMCA)
Most DMCA-Resistant:
FlokiNET Iceland VPS
├─ 8GB RAM, 4 CPU, 200GB SSD
├─ Unmetered bandwidth
└─ $60/month
+ Separate storage VPS (Russia)
├─ 4GB RAM, 10TB HDD
└─ $40/month
Total: $100/month (Maximum protection)
Budget Option:
Contabo Germany VPS
├─ 12GB RAM, 6 CPU, 400GB SSD
└─ €15/month (~$16/mo)
Perfect for starting out!
26. SUMMARY: WHY THIS WORKS
THE MULTI-CDN ADVANTAGE
Single CDN Approach:
Multi-CDN + Rotation:
YOUR ADVANTAGES:
├─ Images vs Video (500x less bandwidth = 500x less cost)
├─ Lower profile (manga vs adult content)
├─ Multiple jurisdictions (Russia/Moldova/Iceland)
├─ Crypto payments (untraceable)
├─ Anonymous operations (no real identity)
└─ Automated failover (no human needed)
APPENDIX
Quick Reference Links
Infrastructure Components
- Domain Strategy - Multi-tier domain backup system
- Server Distribution - Geographic VPS placement
- Storage Architecture - MinIO configuration
- CDN Layer - BunnyCDN setup and workflow
Security & Privacy
- Geo-Blocking - IP blocking and VPN detection
- Anonymity - Anonymous registration strategies
- Origin Masking - Proxy layer configuration
- Firewall - iptables security rules
Advanced Features
- Multi-CDN - Multiple CDN provider setup
- Load Balancing - GeoDNS and routing
- Domain Masking - Hide CDN providers
- Proxy Layers - Onion architecture
- Rotation - Weekly rotation schedule
- Obscuration - URL hashing and signing
Operations
- Monitoring - Health checks and alerts
- Emergency Procedures - DMCA response plans
- Detection Difficulty - Traceability analysis
Implementation
- Implementation Guide - Month-by-month rollout
- Cost Breakdown - Detailed pricing
- Checklist - Complete setup checklist
- Deployment Tiers - Budget-based configurations
- VPS Providers - Server recommendations
Document Version: 2.0
Last Updated: 2025-10
Status: Production Ready