Cloudflare Setup

Overview

apibay-labs uses a prod-only Cloudflare account.

Workers / Pages keep v6 names (core-api, ops-control, web-public, …).
D1 / KV / R2 / Queue use Governance v3 policy names (apibay-core-db, kv-gateway-routes, …).

Full checklist: core-platform/docs/CLOUDFLARE_SETUP.md. Plans: Governance v3, 타 계정 오염 제거.

Astro (this docs site) is not DataStax Astra DB.

Account isolation

Local credentials: ~/.config/apibay-labs/cloudflare.env (direnv via ~/develop/apibay-labs/.envrc).
Pin the same apibay account_id in every wrangler.prod.toml / Worker wrangler.jsonc.
Populate CF_BLOCKED_ACCOUNT_IDS with other orgs’ account IDs (local only — do not commit).
Never wrangler login / local wrangler deploy / local wrangler secret put.
Preflight: node scripts/account-guard.mjs (expects CF_WORKERS_SUBDOMAIN=apibay77).

Quick reference — Workers / Pages

Resource	Name
Core API Worker	`core-api`
Control plane Worker	`ops-control`
Edge gateway Worker	`edge-gateway`
Email Worker	`infra-email`
Git sync Worker	`infra-git-sync`
Admin Pages	`core-admin`
Tenant dashboard Worker	`app-dashboard`
Marketing Worker	`web-public`
Public docs Pages	`docs-public`
Internal docs Pages	`docs-internal`
Customer portal Pages	`app-portal`
Flow editor Pages	`core-flow-editor`

Quick reference — storage

Resource	Policy name
Tenant D1	`apibay-core-db`
Ops D1	`apibay-ops-db` (do not merge without STOP-AND-ASK)
Files R2	`r2-platform-files`
Admin assets R2	`r2-admin-assets`
Session KV	`kv-platform-session`
Rate-limit KV	`kv-gateway-rate-limit`
Route/manifest KV	`kv-gateway-routes`
Email queue	`q-email-outbound` + `-dlq`
Compile queue	`q-gateway-compile` + `-dlq`

Local dev

# From each Worker repo
cp .dev.vars.example .dev.vars
wrangler dev -c wrangler.prod.toml --local
pnpm db:migrate:local            # D1 — apibay-core-db / apibay-ops-db

# Frontends (web-public)
pnpm --filter @apibay-labs/admin dev
pnpm --filter @apibay-labs/dashboard dev
pnpm --filter @apibay-labs/flow-editor dev

D1/KV IDs stay placeholders until provisioned on the local cloudflare.env account — see core-platform docs/CLOUDFLARE_SETUP.md § Local account inventory. Token needs D1:Edit + KV:Edit. Local --local does not require production IDs.

Do not use wrangler.dev.toml or wrangler.stg.toml.

Remote migrations

# core-platform
pnpm db:migrate:prod    # apibay-core-db

# infra-control-plane
pnpm db:migrate:prod    # apibay-ops-db

CI

Deploys go through apibay-labs/ops-ci-workflows with secrets: inherit. Org secrets: CLOUDFLARE_API_TOKEN, CLOUDFLARE_ACCOUNT_ID, AUTH_SECRET, INTERNAL_SIG_SECRET, GH_PAT.

Production wrangler secret put and wrangler deploy are CI-only.