Skip to content
Ailaaj Academy

Cloudflare Routing Map

Ailaaj.com Cloudflare Routing Map

Last verified: 2026-05-17

Purpose

This document is the single source of truth for how ailaaj.com should behave during the transitional Cloudflare Worker rollout.

The current goal is not to replace every existing origin yet. The goal is to:

  • keep the live storefront on ailaaj.pk for now,
  • expose the other products under subdirectories on ailaaj.com,
  • keep the existing subdomains alive as technical origins,
  • enforce the apex subpaths as the canonical public URLs for users,
  • preserve POS auth, cookies, service worker, downloads, and Vercel serverless behavior.

Verified current origins

Public/current originProductRepoNotes
https://ailaaj.pkLive storefrontexternal ShopifyRemains the temporary apex fallback
https://app2.ailaaj.comPOS / app upstream originailaaj-connect-hubVercel-hosted; owns /api/*, sw.js, version.json, downloads/*; now served publicly as ailaaj.com/app/*
https://one.ailaaj.comAilaaj One marketing siteone.ailaaj.comVite React app
https://hospital.ailaaj.comHospital marketing sitehospital.ailaaj.comVite React app
https://corporate.ailaaj.comCorporate sitecorporateTanStack Start app
https://talent.ailaaj.comTalent / hiring portalailaajtalenthubVite React app on Vercel
https://app3.ailaaj.comHospital login destination (formerly app2)external/current appReplaced app2; must stay unchanged

Canonical public URL policy

During this phase, the subdomains remain the upstream origins, but users should end up on the apex subpaths as the canonical public URLs:

  • https://ailaaj.com/app/*
  • https://ailaaj.com/one/*
  • https://ailaaj.com/hospital/*
  • https://ailaaj.com/corporate/*
  • https://ailaaj.com/talent/*

Examples:

  • https://one.ailaaj.com/compare -> https://ailaaj.com/one/compare
  • https://hospital.ailaaj.com/platform -> https://ailaaj.com/hospital/platform
  • https://corporate.ailaaj.com/about -> https://ailaaj.com/corporate/about
  • https://pos.ailaaj.com/login -> https://ailaaj.com/app/login
  • https://talent.ailaaj.com/jobs -> https://ailaaj.com/talent/jobs

To make that safe, origin-side canonical redirect logic must skip requests carrying:

  • x-ailaaj-public-host: ailaaj.com

That header marks internal origin fetches coming from the apex Cloudflare Worker and prevents redirect loops.

Phase 1 public behavior on ailaaj.com

Reserved product prefixes

Public URL on ailaaj.comUpstream originUpstream path behaviorNotes
/apphttps://pos.ailaaj.comRedirect to /app/loginPublic entry for POS
/app/*https://pos.ailaaj.comStrip /app before proxyingExample: /app/login -> /login
/onehttps://one.ailaaj.comServe homepage
/one/*https://one.ailaaj.comStrip /one before proxyingExample: /one/blog -> /blog
/hospitalhttps://hospital.ailaaj.comServe homepage
/hospital/*https://hospital.ailaaj.comStrip /hospital before proxyingExample: /hospital/platform -> /platform
/corporatehttps://corporate.ailaaj.comServe homepage
/corporate/*https://corporate.ailaaj.comStrip /corporate before proxyingExample: /corporate/about -> /about
/talenthttps://talent.ailaaj.comServe homepage
/talent/*https://talent.ailaaj.comStrip /talent before proxyingExample: /talent/jobs -> /jobs

Apex fallback behavior

For now, any request to ailaaj.com that does not match a reserved prefix or reserved support path should go to Shopify on ailaaj.pk.

Public URL on ailaaj.comTemporary behavior
/Redirect to https://ailaaj.pk/
Any non-reserved pathRedirect to matching path on https://ailaaj.pk

Reserved POS support paths on the apex host

These must stay available on ailaaj.com because the POS app still uses root-level serverless/API support paths in addition to /app/*.

Public URL on ailaaj.comUpstream origin
/api/*https://app2.ailaaj.com/api/*
/hub-version.jsonhttps://app2.ailaaj.com/hub-version.json
/hub-release.ziphttps://app2.ailaaj.com/hub-release.zip
/spa-manifest.jsonhttps://app2.ailaaj.com/spa-manifest.json

POS support files under /app

These are also required and must resolve correctly through the /app prefix.

Public URLUpstream
/app/sw.jshttps://app2.ailaaj.com/sw.js
/app/version.jsonhttps://app2.ailaaj.com/version.json
/app/downloads/*https://app2.ailaaj.com/downloads/*
/app/hub-version.jsonhttps://app2.ailaaj.com/hub-version.json
/app/hub-release.ziphttps://app2.ailaaj.com/hub-release.zip
/app/spa-manifest.jsonhttps://app2.ailaaj.com/spa-manifest.json

Required edge behavior in the Cloudflare Worker

This routing cannot be handled correctly with DNS alone. It requires a Worker because the edge must do all of the following:

  1. Match prefixes like /app, /one, /hospital, /corporate, /talent.
  2. Strip the public prefix before forwarding to the existing upstream origin.
  3. Rewrite Location headers so upstream redirects stay inside the public prefixed path.
  4. Rewrite absolute upstream hosts in HTML/JS/CSS/text responses:
    • https://app2.ailaaj.com -> https://ailaaj.com/app
    • https://one.ailaaj.com -> https://ailaaj.com/one
    • https://hospital.ailaaj.com -> https://ailaaj.com/hospital
    • https://corporate.ailaaj.com -> https://ailaaj.com/corporate
    • https://talent.ailaaj.com -> https://ailaaj.com/talent
  5. Rewrite root asset URLs such as /assets/... to prefixed paths like /one/assets/..., /hospital/assets/..., /corporate/assets/..., /talent/assets/..., /app/assets/....
  6. Rewrite common static root paths like favicon/robots/sitemap/OG image references to their prefixed equivalents where needed.
  7. Preserve POS root support paths like /api/* on the apex host.
  8. Fallback non-reserved traffic to Shopify on ailaaj.pk.

Verified code readiness by repo

ailaaj-connect-hub

Status: ready for Worker phase 1

Verified:

  • production build passes,
  • router is /app-aware,
  • service worker registration is /app-aware,
  • version checks are /app-aware,
  • downloads manifest/install flow is /app-aware,
  • several hard redirects were changed to respect /app,
  • root-level /api/* serverless usage still exists and must be proxied on the apex host,
  • SEO metadata is apex-aware with og:url: https://ailaaj.com/app/login and canonical URLs.

Important note:

  • the built HTML still emits root asset URLs like /assets/..., so the Worker must rewrite those to /app/assets/...,
  • upstream origin is now app2.ailaaj.com (formerly pos.ailaaj.com; see domain migration notes).

Key files:

  • src/lib/appBasePath.ts
  • src/App.tsx
  • src/main.tsx
  • public/sw.js
  • vercel.json

one.ailaaj.com

Status: ready for Worker phase 1 with edge rewriting

Verified:

  • production build passes,
  • router basename support exists,
  • canonical/public URL helper exists,
  • login CTA now points at https://ailaaj.com/app/login,
  • internal links use a base-path helper,
  • sitemap script accepts SITE_URL / VITE_PUBLIC_SITE_URL.

Important note:

  • static/built HTML still emits root asset URLs like /assets/...,
  • default source HTML still contains subdomain canonical/meta values,
  • therefore the Worker must rewrite text responses for public /one behavior.

Key files:

  • src/lib/public-url.ts
  • src/App.tsx
  • src/components/SEO.tsx
  • scripts/generate-sitemap.mjs

hospital.ailaaj.com

Status: ready for Worker phase 1 with edge rewriting

Verified:

  • production build passes,
  • router basename support exists,
  • canonical/public URL helper exists,
  • structured-data URL normalization exists,
  • app2.ailaaj.com/login remains intentionally unchanged.

Important note:

  • built HTML still emits root asset URLs like /assets/...,
  • source/static HTML still defaults to subdomain canonical/meta values,
  • therefore the Worker must rewrite text responses for public /hospital behavior.

Key files:

  • src/lib/public-url.ts
  • src/App.tsx
  • src/components/SEO.tsx
  • scripts/generate-sitemap.mjs

corporate

Status: ready for Worker phase 1 with edge rewriting

Verified:

  • production build passes,
  • TanStack router basepath support exists,
  • public URL helper exists,
  • business-unit links were aligned to apex public paths.

Important note:

  • this app still needs the Worker to expose it under /corporate/*,
  • SSR/client asset paths remain rooted at /assets/..., so the Worker must rewrite public responses accordingly.

Key files:

  • src/lib/public-url.ts
  • src/router.tsx
  • src/routes/index.tsx
  • src/components/business-units.ts

ailaajtalenthub

Status: ready for Worker phase 1 with edge rewriting

Verified:

  • runtime router basename support now exists,
  • canonical/public URL helper exists,
  • direct talent.ailaaj.com/* browser visits can be redirected to https://ailaaj.com/talent/*,
  • Vercel redirect rules now skip requests carrying x-ailaaj-public-host,
  • shared job links and auth reset links now resolve to the apex public path.

Important note:

  • built HTML still emits root asset URLs like /assets/...,
  • therefore the Worker must rewrite text responses for public /talent behavior.

Key files:

  • src/lib/public-url.ts
  • src/App.tsx
  • src/main.tsx
  • src/pages/JobDetails.tsx
  • vercel.json

custom_store_front_ailaaj

Status: not part of phase 1 public cutover

Verified:

  • production build passes,
  • repo is available for the later storefront cutover,
  • current SEO/canonical source of truth is still https://ailaaj.pk.

Implication:

  • this is not the current apex target for ailaaj.com,
  • phase 1 should keep apex fallback on Shopify,
  • phase 2 can replace Shopify fallback with this repo once storefront cutover is approved.

Key files:

  • src/lib/seo.ts
  • src/server.ts

Existing Worker script in repo

The verified Worker source file is:

  • cloudflare/ailaaj-com-router.js

That script already implements the core phase 1 design:

  • /app, /one, /hospital, /corporate, /talent prefix routing,
  • prefix stripping before origin fetch,
  • /app -> /app/login redirect,
  • apex /api/* routing to POS,
  • Shopify fallback for non-reserved paths,
  • host replacement inside text bodies,
  • root /assets/* rewriting to prefixed asset paths,
  • POS rewrites for /app/sw.js, /app/version.json, and /app/downloads/*,
  • Location header rewriting for redirects.

Cloudflare dashboard requirements

Before enabling the Worker on ailaaj.com, do the following:

  1. Disable/remove the current apex redirect rule that sends ailaaj.com to ailaaj.pk.
  2. Attach the Worker to the appropriate route for the apex host.
  3. Make sure no higher-priority redirect/page rule overrides Worker execution.
  4. Keep the existing subdomain origin mappings unchanged:
    • app2.ailaaj.com (upstream origin for public ailaaj.com/app/*)
    • one.ailaaj.com
    • hospital.ailaaj.com
    • corporate.ailaaj.com
    • talent.ailaaj.com
  5. Keep app3.ailaaj.com unchanged (new hospital login destination, replacing former app2.ailaaj.com).
  1. Deploy/attach the Worker for ailaaj.com.
  2. Verify:
    • /one
    • /hospital
    • /corporate
    • /talent
    • /app/login
    • /app/sw.js
    • /app/version.json
    • /app/downloads/latest.json
    • /api/* from the public apex host
  3. Keep monitoring subdomain fallbacks directly.
  4. Later, replace Shopify fallback with custom_store_front_ailaaj when storefront cutover is approved.

Final phase 1 summary

During phase 1:

  • ailaaj.com is not yet the new storefront,
  • it is the public umbrella host,
  • Shopify remains the fallback storefront,
  • /one, /hospital, /corporate, /talent, and /app are exposed through Cloudflare Worker path-based proxying,
  • the direct subdomains remain alive as technical origins,
  • the apex subpaths are the canonical public URLs users should land on.