Skip to content
GERCIA Engineering

ADR-003: Subdomain Segregation & Internal OIDC Auto-Redirect

Status

Section titled “Status”

ACCEPTED (2026-08-30)

Context

Section titled “Context”

Serving internal backoffice operations and B2B client workloads under the same portal URL risked access confusion, exposed administrative routes to clients, and added unnecessary manual login steps for internal GERCIA staff.

Decision

Section titled “Decision”
  1. Segregate web application routing across specialized subdomains:
    • app.gercia.com.br: B2B SaaS portal for multi-tenant clients (Doctors, Clinics, Pharmacies).
    • ops.gercia.com.br: Internal Operations & Backoffice platform with automated Google Workspace OIDC redirect (hd=gercia.com.br).
    • eng.gercia.com.br: Internal Engineering & Architecture portal (Astro Starlight in docs/private/) behind Cloudflare Zero Trust.
    • docs.gercia.com.br: Public Help Center & User Manuals (Astro Starlight in docs/public/).
  2. Enforce Cloudflare Zero Trust / Access policies on internal subdomains (ops., eng.).

Consequences

Section titled “Consequences”
  • Positive: Zero friction for GERCIA staff (instant 1-second Google Workspace SSO login).
  • Positive: Strict attack surface reduction with Cloudflare Access protection for internal portals.
  • Positive: Clean, unified host routing in Gercia.Web without multiple heavy container deployments.