Enabling HTTP/3 — Cloudflare for the Portfolio, Traefik for the Platform
HTTP/3 runs over QUIC on UDP 443 instead of TCP. Browsers love it for fewer round trips and better behavior on lossy networks. Shared Apache on IONOS — where my static portfolio lands over SFTP — typically stops at TLS 1.2 and has no HTTP/3. I did not fight the origin. I terminated modern TLS at the edge, and I enabled QUIC properly on the VPS that already runs Traefik.
The public site rafaelgonzalezalbes.com is a React SPA deployed to IONOS. Platform hosts — git, ci, pm, status, security, docs — sit on a VPS behind Traefik with Let's Encrypt. Both should speak TLS 1.3 and advertise HTTP/3 to browsers. The wiring is different because the origins are different.
Rule of thumb: do not orange-cloud platform subdomains through Cloudflare unless you intentionally change ACME and routing. Those names stay DNS-only to the VPS. Only the portfolio apex and www ride the Cloudflare proxy.