← Platform

Cloudflare

Status
in-flight
Tier
Tier 2 — Platform
Owner
Ryan Colston
Started
2026-04-24

One-line description. Cloudflare is the edge platform under everything customer-facing — DNS for rycolston.com, every static site on Pages, and the natural home for future Workers / R2 / Browser Rendering work.

Why

GCP isn't the right tool for every workload. Public-facing static sites, DNS, edge logic, and webhook handlers run faster, cheaper, and simpler on Cloudflare than on Cloud Run.

This hub exists because Cloudflare is no longer a "captured option." It's a live operational dependency. DNS for rycolston.com lives there. Five+ Pages projects ship through it. Future projects (wallet pass, lead-magnet form handlers, browser screenshot jobs) will probably land on Workers.

Without a hub, Cloudflare-related decisions get scattered across Reference/Web Properties.md, individual project hubs, and feedback memory. The hub centralizes credentials path, deployment patterns, and the shortlist of what to build next on this platform.

Current state

Active. Powering production sites.

Corrected 2026-06-30 — the line above was wrong, not just stale (confirmed via live Cloudflare API, earliest resource predates even the 5/6 "Last update" below): Workers, R2, KV, and Access are all live in production. Workers (3): smb-review-rycolston-com (6/25), app-the50os-com (6/21), board-rycolston-com (6/14). R2 (2 buckets): handbook-audio (5/21), handbook-offers (6/04). KV (2): GAMEPLAN_KV, handbook-completion. Cloudflare Access gates app.the50os.com and other internal tools. D1, Vectorize, Workers AI, Stream, Browser Rendering genuinely still unused.

2026-07-09 free-vs-paid review. Ran a review of whether to upgrade the free account, mapping 60 days of monorepo commits against Cloudflare's full catalog. Two outputs: - Adoption backlog filed as RYR-104 (AI Gateway, Web Analytics, Rate Limiting, D1, Durable Objects — all free or bundled into Workers Paid) and RYR-105 (Turnstile on public forms). Both in the Infra project, Backlog. - Pending spend decision (Ry's call, NOT yet actioned): turn on Workers Paid ($5/mo). Reason: free KV cap is 1,000 writes/day and the completion sync already had to be engineered to stay under it; $5/mo removes that ceiling and buys large CPU/subrequest headroom. Watch item, not a build: Zero Trust is free to 50 users then $7/user/mo, and the team (~27 agents) is growing toward that wall.

Next 3 actions

(none — surface when relevant)

When a Workers / R2 / Browser Rendering use case appears, the next moves are:

  1. First Worker: probably the Appointment Wallet Pass generator (FUB webhook → Google Wallet pass JWT). Lives well at the edge.
  2. First R2 bucket: any public file workload that's currently on GCS and incurring egress costs.
  3. First Browser Rendering job: replace any local Playwright / headless Chrome process (CMA PDF gen, screenshot-based site-doc captures).

Capability map

What Cloudflare offers that's worth knowing:

When to reach for Cloudflare over GCP

When to stay on GCP

Decisions log

Open issues

Backlog now lives in Linear (Infra project). Candidate workloads:

Sites currently on Cloudflare

Source of truth: Web Properties. Snapshot as of 2026-05-06:

Credentials & deploy pattern

API token: op item get mieu4nz3ygy7el3mf4bxpznlaa --vault POSPJ --fields credential --reveal Account ID: 9f54c7990a6d42f0c504318d2031d9de rycolston.com zone: 731d5e532ef078b3610ff07ce41535b5

Standard Pages deploy:

CLOUDFLARE_API_TOKEN=$(op item get mieu4nz3ygy7el3mf4bxpznlaa --vault POSPJ --fields credential --reveal) \
CLOUDFLARE_ACCOUNT_ID=9f54c7990a6d42f0c504318d2031d9de \
wrangler pages deploy . --project-name=<project> --branch=main --commit-dirty=true

References