Networking & DNS

DNS delegation, TLS certificates, load balancing and the public request path.

The portfolio is exposed to the internet using AWS managed networking services. Requests are resolved through Route 53, encrypted using AWS Certificate Manager (ACM), and routed by an Application Load Balancer before reaching the application.

DNS Ownership

A domain registrar and a DNS provider perform different roles.

The root domain, trentmizzi.me, is managed through the domain registrar. A dedicated portfolio.trentmizzi.me subdomain is delegated to a Route 53 hosted zone, which contains the records used by portfolio environments. The staging application is exposed at staging.portfolio.trentmizzi.me.

Note

Delegating the portfolio subdomain requires publishing the Route 53 hosted zone's name-server records in the parent DNS zone. This gives Route 53 authority over portfolio.trentmizzi.me without moving DNS management for the entire root domain.

HTTPS

TLS certificates are provisioned and automatically renewed using AWS Certificate Manager (ACM).

The Application Load Balancer terminates HTTPS connections before forwarding requests to the application over HTTP within the VPC. This removes the need to manage certificates within application containers while providing a single location for public TLS configuration.

Benefits include:

Automatic certificate renewal
No certificate management inside application containers
Centralised TLS configuration
HTTPS enforced between the browser and the public load balancer

Route 53 Alias Records

Rather than pointing the staging hostname to a fixed IP address, a Route 53 Alias record maps staging.portfolio.trentmizzi.me to the Application Load Balancer.

Unlike a traditional A record containing a fixed IP address, the Alias record targets the AWS load balancer directly and continues to resolve as the load balancer's underlying addresses change.

Tip

Alias records provide similar behaviour to CNAME records for AWS resources but can also be used at the zone apex, where standard DNS CNAME records are not permitted.

Public Request Flow

Diagram

flowchart LR
    User["Browser"]
    DNS["Route 53"]
    ALB["Application Load Balancer"]
    App["Next.js Application"]

    User --> DNS
    DNS --> ALB
    ALB --> App

The request path is intentionally simple:

The client resolves the application hostname using Route 53.
Route 53 returns the Application Load Balancer as the destination.
The Application Load Balancer terminates the TLS connection.
The request is forwarded to the application.

This architecture separates DNS, certificate management and traffic routing into dedicated AWS managed services, allowing the application to focus solely on serving requests.