Useful pairing of nginx as the origin edge with Cloudflare in front. The ops trap I still see is double compression or double caching: Cloudflare already may gzip and cache, so turning gzip and a long proxy_cache on at nginx without aligning Cache-Control just wastes CPU and makes purges confusing. I terminate TLS at Cloudflare or at nginx once, not both with conflicting redirects, and I forward the real client scheme via CF-Connecting-IP / X-Forwarded-Proto into the Node app so absolute URLs stay https.

After cutover I hit the app hostname with a cache-busting query and again without, comparing CF-Cache-Status and the origin access log. A permanent HIT at the CDN while Node never sees traffic is fine for static; for authenticated API paths I set Cache-Control private or bypass at Cloudflare and leave nginx as a thin reverse proxy with Host plus forwarded headers only. Also confirm websocket or long-poll paths are excluded from CDN caching, or clients reconnect forever while the edge serves a stale 200.