11 hours ago
All services (frontend, backend, Postgres) are in europe-west4-drams3a. The custom domains www.easypdf.fr and easypdf.fr are CNAME'd to their Railway targets and proxied through Cloudflare (free plan).
SYMPTOM
Every request going through the Cloudflare-proxied domain lands on x-railway-edge: mel1. The exact same services reached over their native Railway domains land on cdg1. Measured from France:
www.easypdf.fr/api/stats/public -> x-railway-edge: mel1, TTFB ~626 ms
easy-pdf.up.railway.app/ -> x-railway-edge: cdg1, TTFB ~60 ms
easy-pdf-backend.up.railway.app/ -> x-railway-edge: cdg1, TTFB ~24 ms
20 out of 20 requests through the proxied domain hit mel1 (before enabling Argo). The Cloudflare PoP itself is correct: cf-ray ends in -MRS (Marseille). Only the Cloudflare-to-origin leg is wrong.
DNS
www.easypdf.fr CNAME 1m8651q6.up.railway.app -> 69.46.46.74 (proxied)
easypdf.fr CNAME 9520oid3.up.railway.app -> 69.46.46.120 (proxied)
WHAT I RULED OUT
- Not hostname or IP specific. A custom domain created just now got w1irt8wq.up.railway.app -> 69.46.46.127, same /24. All of 69.46.46.73, .74, .120, .122 and .127 answer cdg1 when queried directly from France, including the exact target Cloudflare uses.
- Not TLS or certificates: handshake 22-43 ms, valid chains, TLS 1.3.
- Not the origin app: SSR TTFB is 59-114 ms over the native Railway domain.
ARGO SMART ROUTING
Enabled as a workaround. It moves about 50% of requests to bcn1 (~110 ms), but the other 50% still land on mel1 (~654 ms). p90 is unchanged.
SIMILAR REPORTS
This looks like the same class of issue as two already-resolved threads: "Metal Edge routing with Cloudflare proxy" (europe-west4 origin going to asia-southeast1 through the Cloudflare proxy, internal ticket "Cloudflare incorrect routing", marked resolved) and "Edge routing going through Asia instead of Amsterdam" (fixed by moving traffic to new edge subnets).
Happy to share project and service IDs or run any diagnostic you need.
3 Replies
Status changed to Awaiting Railway Response Railway • about 11 hours ago
11 hours ago
Your report is logged and tracked on our side, and the diagnostics you included are exactly what we would have asked for.
The mis-selection is happening on the Cloudflare-to-origin leg, not on the path to our edge. Your own measurements confirm that: the same services resolve to cdg1 when the records are queried directly. We take on edge routing work of this shape once we see it reported across multiple accounts and can identify a shared pattern in the affected paths. Right now this is an isolated report, so it is not something we can action immediately.
The workaround available today is to take the records out of Cloudflare's proxy and set them to DNS only. That removes the Cloudflare-to-origin hop entirely and resolves straight to our edge, which is already selecting cdg1 for you. Argo will not fully close the gap, since it is still choosing among the same origin paths.
Status changed to Awaiting User Response Railway • about 11 hours ago
10 hours ago
Thanks, that matches what I measured, and I understand the threshold for acting on it. Two findings that may be useful for the shared pattern you are looking for, and for anyone landing on this thread.
TIERED CACHE WORKS AROUND IT, WITHOUT LEAVING THE PROXY
Enabling Cloudflare Tiered Cache (Smart topology, available on the Free plan) changed the picture completely. Before, forced cache MISSes split between mel1 (1350-1390 ms) and bcn1 (~90 ms). After, 10 out of 10 MISSes stay in Europe: ams1 five times, bcn1 four times, cdg1 once, median 123 ms on assets and 114 ms on HTML. ams1 is the same city as the origin.
The upper tier appears to select a PoP near the origin instead of following the anycast path that was picking mel1. The bad path is still there, it is simply no longer on the critical path for cached content. That may be a useful datapoint on where the mis-selection actually happens.
WHY DNS ONLY IS NOT VIABLE HERE
Most of this site's traffic is organic search from Indonesia and India. Removing the proxy would also remove the Cloudflare edge cache, so those visitors would go from a cache hit at a nearby PoP to a full trip to Amsterdam on every page. Measured HTML TTFB is 56 ms from the edge cache against 59-114 ms from the native Railway domain measured in France, and considerably worse from Asia. DNS only would fix the routing but cost more than it saves in this particular case.
ON THIS BEING AN ISOLATED REPORT
The thread composer displayed "4 similar threads found" while I was writing this one, and the two I linked were the same shape and were actioned. Not pushing for priority, just flagging it in case they help identify the shared pattern.
Happy to share project and service IDs, run traceroutes from specific regions, or re-test if you push any change to the edge subnets.
Status changed to Awaiting Railway Response Railway • about 10 hours ago
9 hours ago
The Tiered Cache finding is genuinely useful, thanks for documenting it. The upper tier bypassing the bad anycast path and selecting a PoP near the origin is a strong signal about where the mis-selection sits in the Cloudflare-to-origin leg, and it is a cleaner workaround than Argo for this shape of problem.
Status changed to Awaiting User Response Railway • about 9 hours ago