Skip to content

ADR 0014: EdgeOne CDN — COS Origin with WeCom OAuth

Status

Accepted

Date

2026-08-10

Context

OVES requires a multi-site documentation system with WeCom OAuth authentication. The system must:

  1. Serve 5 document types on branded subdomains (docs, decks, memo, training, media)
  2. Authenticate users via WeCom OAuth (internal SSO)
  3. Support global access (employees worldwide + select external viewers)
  4. Route each subdomain to a different COS prefix on a single bucket

Constraint: WeCom OAuth Requires ICP

Per WeCom developer documentation (可信域名配置要求):

"可信域名必须通过ICP备案验证。备案主体须与企业微信认证的企业主体相同或具有关联关系。"

The trusted domain for WeCom OAuth callbacks must be ICP-registered, and the ICP entity must match the WeCom enterprise entity (浩勉/Omnivoltaic). This is a hard requirement — not optional, not bypassable.

Why EdgeOne Over Simpler Alternatives

Approach Multi-subdomain routing WeCom OAuth Global CDN Monthly Cost
COS custom domain alone ❌ One domain → one path ❌ No edge compute Basic CDN $0
CloudStudio ❌ *.agentos-app.net URLs ❌ Domain not ICP'd No CDN $0
EdgeOne Personal ✅ Per-domain origin groups ✅ Edge Functions ✅ 3200+ nodes ¥9.9/mo

COS alone cannot route 5 subdomains to 5 different prefixes in one bucket. CloudStudio cannot support ICP-required WeCom OAuth (domains are not ours). EdgeOne is the minimum viable solution.

Current State

Artifact Detail
ICP ✅ Approved for omnivoltaic.cn (entity: 浩勉)
Domain omnivoltaic.cn, DNS in Tencent Cloud
COS Bucket oves-cos-bucket-1437812500, ap-singapore
COS Credentials SecretId/SecretKey (verified 2026-08-05)
COS Structure docs/, decks/, memo/, training/, media/ prefixes ready
EdgeOne Plan Personal — ¥9.9/mo (50 GB traffic, 3M requests)

Decision

Deploy EdgeOne Personal plan with COS origin. Route 5 subdomains via acceleration domains. Add WeCom OAuth via Edge Functions after base CDN is live.

Verified Requirements Chain

WeCom OAuth → ICP-registered domain (hard requirement, confirmed 2026-08-09)
ICP domain → EdgeOne CDN with China acceleration
5 subdomains → EdgeOne per-domain origin groups → single COS bucket
Global access → EdgeOne global nodes (3200+) + Singapore COS origin

Phase 1: EdgeOne Site + Domains (HW — Console — 20 min)

  1. Go to https://console.cloud.tencent.com/edgeone
  2. Add Site → omnivoltaic.cn → CNAME access mode → verify domain
  3. Domain Management → add 5 acceleration domains:
Acceleration Domain Origin COS Path
docs.omnivoltaic.cn COS bucket → select oves-cos-bucket-1437812500 (ap-singapore) /docs/
decks.omnivoltaic.cn Same bucket /decks/
memo.omnivoltaic.cn Same bucket /memo/
training.omnivoltaic.cn Same bucket /training/
media.omnivoltaic.cn Same bucket /media/
  1. SSL: Enable free managed certificate (auto-issued, auto-renewal)
  2. DNS: EdgeOne provides 5 CNAMEs → add to Tencent DNS console (https://console.cloud.tencent.com/cns)

Phase 2: Origin Path Routing

Each subdomain acceleration domain has its origin path set to the matching COS prefix. EdgeOne strips the subdomain and routes to the correct bucket path:

User → docs.omnivoltaic.cn/adr/0001/ → EdgeOne → COS /docs/adr/0001/index.html
User → decks.omnivoltaic.cn/pitch/  → EdgeOne → COS /decks/pitch/index.html

Phase 3: WeCom OAuth (Edge Functions — After CDN Live)

  1. In WeCom Admin Console: configure omnivoltaic.cn as trusted domain
  2. EdgeOne Console → Edge Functions → deploy per-subdomain auth:
  3. docs, memo, training: WeCom SSO only (internal)
  4. decks, media: WeCom SSO + optional guest tokens (external)
  5. Attach trigger rules to each subdomain

Phase 4: CI/CD Integration

  1. Update mkdocs site_url to https://docs.omnivoltaic.cn/ (per subdomain, per repo)
  2. Enable use_directory_urls: true (EdgeOne handles directory indexes)
  3. GitHub Actions deploys → COS upload → EdgeOne serves (no CloudStudio step)

Consequences

Benefits

  • WeCom OAuth: compliant with hard ICP requirement — enterprise employees log in with existing credentials
  • Per-subdomain access control: internal-only vs. internal+external via subdomain + Edge Function
  • Branded URLs: docs.omnivoltaic.cn matches OVES identity
  • China + global: Singapore COS origin → EdgeOne global nodes → <10ms China latency
  • Zero infrastructure: no servers, no load balancers, no SSL management

Trade-Offs

  • ¥9.9/mo ongoing cost (trivial for enterprise use)
  • Manual console setup in Phase 1 (HW must perform — no API for initial site creation)
  • CNAME DNS propagation: 2-48 hours
  • EdgeOne 50 GB traffic cap — monitor with first deployments

Verified Sources

Supersedes

  • ADR 0009 — EdgeOne Pages approach (replaced by EdgeOne CDN with COS origin)

Superseded By

None.