Cloudflare Platform

Purpose

The operational detail behind every Cloudflare primitive this repository uses - Workers, Static Assets, D1, R2, and how bindings/secrets/environment variables differ from each other.

Inventory (verified against every wrangler.jsonc directly)

Resource	Name	Bound in
D1 database	akshaya-group-global (binding DB)	workers/api, apps/corporate-web, apps/software-web, apps/admin-web
R2 bucket	akshaya-group-global-files (binding FILES)	same 4 Workers as D1
Email (send_email)	NOTIFY_EMAIL	workers/api only
Worker Static Assets	7 (one per app)	every apps/*
Dynamic Worker (own routes beyond static assets)	3 (corporate-web, software-web, admin-web via run_worker_first) + the dedicated workers/api	—

Four kinds of "configuration" - know the difference

	Where it lives	Committed to git?	Example
Normal environment variable	.env/.env.example, read via import.meta.env.VITE_* at build time	.env no, .env.example yes	VITE_API_BASE_URL (currently unused - see Applications overview)
Wrangler vars	wrangler.jsonc's vars block, baked in at deploy time, readable by the Worker at runtime	Yes - not secret by nature	APP_ENV, ALLOWED_ORIGINS, NOTIFICATION_EMAIL
Cloudflare Worker secret	Set via wrangler secret put, never in any file, encrypted at rest by Cloudflare	Never	TURNSTILE_SECRET_KEY, ADMIN_BOOTSTRAP_TOKEN
GitHub Actions secret	Repo Settings → Secrets and variables → Actions	Never	CLOUDFLARE_API_TOKEN, CLOUDFLARE_ACCOUNT_ID

A GitHub Actions secret authenticates CI to deploy Workers; a Cloudflare Worker secret is read by the Worker itself at runtime. They are configured in completely different places and neither exposes the other - see CI/CD → Secrets.

Pages in this section

• Workers - every Worker, its bindings, run_worker_first behavior.
• Static Assets - the SPA-fallback pattern used by all 7 apps.
• D1 - schema, migrations, local vs. remote, safe read commands.
• R2 - bucket usage, upload/download flow, security.
• Domains - every custom domain/route.
• Wrangler - the CLI itself: auth, dev, deploy, tail.
• Troubleshooting.

Existing infrastructure notes

This portal reuses and preserves infrastructure/cloudflare/README.md (one-time bootstrap procedure) - see Infrastructure → Cloudflare for how its content maps into this portal, including where it's now stale (it predates embroidery-web/admin-web).