---
sidebar_label: Static files
toc_max_heading_level: 3
doc_id: 7a3e1f92-4b8d-4c2e-9a15-6d0f8e2b7c43
description: >-
  Deploy static file applications like SPAs and static websites using the
  built-in Static files scope type with support for AWS and Azure.
keywords:
  - static files
  - static website
  - SPA
  - CloudFront
  - Azure CDN
  - scope type
  - agent-backed scopes
---

# Static files scope

The Static files scope lets you deploy single-page apps (SPAs), static websites, and front-end bundles directly from nullplatform. It provisions a CDN distribution, configures DNS and HTTPS, and manages deployments using OpenTofu.

## When to use it

Use the Static files scope when your application only ships static file assets (HTML, CSS, JS, images), doesn't need a server-side runtime, and needs to be distributed through public custom domains.

## Supported cloud providers

The Static files scope works with the following cloud providers:

| Cloud provider | CDN / Distribution | DNS | Storage |
|---|---|---|---|
| AWS | CloudFront | Route 53 | S3 |
| Azure | Azure CDN | Azure DNS | Blob Storage |

You can add support for other cloud providers. See [Extend the scope](/docs/agent-backed-scopes/static-files/extend) for details.

## What gets provisioned

When you deploy a Static files scope, nullplatform provisions and manages the following infrastructure:

### AWS (CloudFront + Route 53)

- **CloudFront distribution** with HTTPS, gzip compression, and SPA-friendly error handling (404/403 → `index.html`)
- **S3 bucket policy** for secure CloudFront-only access via Origin Access Control (OAC)
- **Route 53 DNS record** (A alias) pointing your custom domain to the distribution
- **Automatic cache invalidation** on each deployment

### Azure (Azure CDN + Azure DNS)

- **Azure CDN profile and endpoint** serving content from Blob Storage, with SPA routing, HTTPS redirect, and cache rules
- **Azure DNS CNAME record** pointing your custom domain to the CDN endpoint
- **CDN-managed HTTPS certificate** for custom domains (TLS 1.2)
- **Blob Storage** path-based origin for asset isolation

## How it works

When you trigger a deployment, the scope runs through the following steps using OpenTofu:

```mermaid
flowchart LR
    A["**Deploy triggered**<br/>nullplatform resolves the DNS zone<br/>and computes the subdomain"]
    B["**Infrastructure applied**<br/>OpenTofu provisions the CDN,<br/>bucket policy, and DNS record"]
    C["**Assets served**<br/>CDN origin points to<br/>the new release path"]

    A --> B --> C

    classDef np    fill:#e6faf4,stroke:#00b894,color:#0b1e3f,stroke-width:1.5px;
    classDef infra fill:#eef3fb,stroke:#274a86,color:#0b1e3f,stroke-width:1.5px;
    class A np;
    class B,C infra;

    linkStyle 0 stroke:#00b894,stroke-width:2px;
    linkStyle 1 stroke:#274a86,stroke-width:2px;
```

1. Nullplatform resolves your DNS zone and computes the subdomain (`{app-slug}-{scope-slug}.{domain}`).
2. The scope provisions a CDN distribution pointed at your assets in storage and creates a bucket policy for secure access.
3. OpenTofu applies the infrastructure changes (`tofu init` + `tofu apply`).
4. DNS is updated and traffic starts flowing to the new release.

## Deployment strategies

- **Initial deployment**: provisions all infrastructure from scratch (CDN, DNS, bucket policy) and points the distribution to the release's asset path in your storage bucket.

- **Blue-green deployment**: reuses the initial deployment setup. Since Static files are immutable and stored at versioned paths in the bucket, each deployment updates the CDN origin path to point to the new release.

:::warning Switching traffic is not supported
The **switch traffic step is not supported** for Static files. Traffic switches instantly when the CDN origin path is updated. **To roll back, trigger a new deployment** pointing to the previous release.
:::


## Custom domains

Nullplatform configures custom domains automatically:

- **AWS**: the scope reads the `hosted_public_zone_id` from your cloud-provider configuration, resolves the domain from Route 53, and creates an alias record. If a wildcard ACM certificate exists for the domain, HTTPS is enabled automatically.

- **Azure**: the scope reads `public_dns_zone_name` and `public_dns_zone_resource_group_name` from your cloud-provider configuration, verifies the DNS zone exists, and creates a CNAME record pointing to the Azure CDN endpoint.

The subdomain follows the pattern `{application-slug}-{scope-slug}`, resulting in URLs like `my-app-production.example.com`.

## Lifecycle actions

| Action | Description |
|---|---|
| `start-initial` | Provisions all infrastructure (CDN, DNS, bucket policy) for the first deployment |
| `start-blue-green` | Updates the CDN origin path to point to the new release |
| `delete-deployment` | Destroys all provisioned infrastructure |

## Next steps

- [Set up the Static files scope](/docs/agent-backed-scopes/static-files/setup): prerequisites and agent permissions for AWS and Azure
- [Extend provider support](/docs/agent-backed-scopes/static-files/extend): define cloud provider settings, DNS zones, and state backend via the UI
- [Scope types](/docs/agent-backed-scopes/scope-types): compare all available scope types
- [Containers](/docs/agent-backed-scopes/containers): the default scope type for long-running workloads