Your origin answers once. The edge answers everywhere.

resource "1boxcdn_zone" "assets" {
  name   = "assets.example.com"
  origin = "https://origin.example.com"
  shield = "FRA"

  cache {
    default_ttl            = 86400
    stale_while_revalidate = 60
    honor_origin_ttl       = true
    key_ignore_query       = ["utm_*", "fbclid"]
  }

  tls {
    min_version  = "1.2"
    hsts_max_age = 31536000
  }

  # Set to 0 to disable image processing
  image_optimizer_quality = 82
}

# Invalidate every object tagged with a release
curl -X POST "https://api.1boxcdn.com/v2/zones/z_8f31/purge" \
  -H "Authorization: Bearer $ONEBOX_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"surrogate_keys": ["release-2026.10.02", "nav"]}'

# => 202 Accepted
# {
#   "purge_id":        "pg_01JQ8ZC4",
#   "objects_matched": 41822,
#   "propagated_ms":   118
# }

// Runs at the edge, before the cache lookup
export default {
  async fetch(request, ctx) {
    const url = new URL(request.url);

    // Serve AVIF to clients that accept it
    if (request.headers.get("accept").includes("image/avif")) {
      url.searchParams.set("format", "avif");
    }

    const res = await ctx.cache.fetch(url, {
      surrogateKeys: ["img", "bucket-" + ctx.pop],
      ttl: 604800,
    });

    return new Response(res.body, {
      headers: {
        "x-1box-pop":   ctx.pop,
        "x-1box-cache": res.state,
      },
    });
  },
};