Zero-Touch Tenant Provisioning with Cloudflare and Forge

The most satisfying feature I built on Endless Fairs is invisible. An event organizer finishes checkout, and a few minutes later their trade fair is live on their own domain with a valid certificate. No ticket, no engineer, no waiting for Monday.

Under the hood it's a chain of queued jobs, each one small and retryable:

AddTenantToCloudFlare
  → AddTenantToHost
    → StartSSLCreationProcess
      → CreateSsl

Step by step

Cloudflare first. A service wraps their API: create the zone, add the DNS records, verify the nameservers, turn on the proxy. Nameserver verification is the flaky part — it can take anywhere from minutes to hours, which is exactly why this is a queued job with retries and not a synchronous call.

Then the servers. A second service talks to the Laravel Forge API. It adds the new site to every app server and to the load balancer, pulling nginx config from templates. If you only add the site to the app servers and forget the balancer, everything works right up until it doesn't.

SSL last. Once DNS resolves, a certificate is requested and auto-renewal is queued. Only then does the tenant flip to live.

What I'd tell past me

• Make every step idempotent. Jobs retry. If "create zone" runs twice, the second run must notice the zone exists and move on, not crash the chain.
• Store the state machine, not just a status. "Provisioning" is useless when something is stuck. "Waiting on nameserver verification since 14:02" tells support exactly what to say.
• Test the unhappy path with a real registrar. Sandbox DNS behaves nothing like a customer who typed the nameservers wrong at their registrar and went to bed.

The pattern generalizes to any SaaS that gives customers their own domain. The tools change; the lesson doesn't: infrastructure work that users never see is still product work.