Route public traffic to private applications with Cloudflare

This post introduces Application Services for Private Origins, a new capability that allows routing public traffic to private origins without exposing those origins to the public Internet. This is achieved by extending Cloudflare's private networking layer directly into the application services stack, enabling security, performance, and programmability services (WAF, bot management, rate limiting, caching, rewrites, Workers) to protect private applications. The feature leverages existing private connectivity patterns like Cloudflare Tunnel, Cloudflare One Client, Cloudflare WAN, and Cloudflare Mesh. It introduces a `use_private_routing` flag for DNS records and extends Spectrum to support private origins via `virtual_network_id`. This enables private IPs to be treated as valid origin targets for public hostnames, unifying the model across Cloudflare products.