Cloudflare Deployment Guide

[
  {
    "AllowedOrigins": ["https://yourdomain.com", "https://*.yourdomain.com"],
    "AllowedMethods": ["GET", "POST", "PUT", "DELETE"],
    "AllowedHeaders": ["*"],
    "ExposeHeaders": ["ETag"],
    "MaxAgeSeconds": 3000
  }
]

{
  "name": "zserved",
  "main": "dist/_worker.js",
  "compatibility_date": "2025-04-15",
  "env": {
    "production": {
      "vars": {
        "NODE_ENV": "production",
        "ENVIRONMENT": "production"
      },
      "kv_namespaces": [
        {
          "binding": "TENANTS",
          "id": "your_production_tenants_id"
        },
        {
          "binding": "FILE_METADATA",
          "id": "your_production_file_metadata_id"
        }
      ],
      "r2_buckets": [
        {
          "binding": "zserved_files",
          "bucket_name": "zserved-files-prod"
        }
      ],
      "d1_databases": [
        {
          "binding": "DB",
          "database_name": "zserved-production",
          "database_id": "your_production_db_id"
        }
      ],
      "vectorize": [
        {
          "binding": "VECTORIZE",
          "index_name": "document-embeddings-prod"
        },
        {
          "binding": "CLIENT_VECTORIZE",
          "index_name": "client-metadata-prod"
        }
      ],
      "autorag": [
        {
          "binding": "LEGAL_RAG",
          "autorag_name": "zserved-legal-knowledge-prod"
        }
      ]
    }
  }
}

name: Deploy to Production

on:
  push:
    branches: [main]

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3

      - name: Setup Node.js
        uses: actions/setup-node@v3
        with:
          node-version: '18'
          cache: 'npm'

      - name: Install dependencies
        run: |
          npm install
          cd webapp && npm install

      - name: Run tests
        run: |
          npm test
          npm run type-check

      - name: Build application
        run: |
          cd webapp && npm run build
          cd .. && npm run build

      - name: Deploy to Cloudflare
        uses: cloudflare/wrangler-action@v3
        with:
          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          environment: production
          command: deploy --env production

// Add to your Worker response headers
const securityHeaders = {
  'Strict-Transport-Security': 'max-age=31536000; includeSubDomains',
  'X-Content-Type-Options': 'nosniff',
  'X-Frame-Options': 'DENY',
  'X-XSS-Protection': '1; mode=block',
  'Referrer-Policy': 'strict-origin-when-cross-origin'
};

// Implement intelligent caching in your Worker
const cache = caches.default;
const cacheKey = new Request(url.toString(), request);

// Check cache first for static content
let response = await cache.match(cacheKey);
if (!response) {
  response = await handleRequest(request);
  // Cache static assets
  if (url.pathname.startsWith('/_astro/')) {
    response.headers.set('Cache-Control', 'public, max-age=31536000');
    await cache.put(cacheKey, response.clone());
  }
}

// Add performance tracking to your Worker
class PerformanceTracker {
  static async track(request: Request, response: Response, duration: number) {
    // Log to external monitoring service
    if (duration > 1000) {
      console.warn(`Slow request: ${request.url} took ${duration}ms`);
    }
  }
}

// /api/health endpoint
export const GET: APIRoute = async ({ locals }) => {
  const health = {
    status: 'healthy',
    timestamp: new Date().toISOString(),
    services: {
      database: await checkDatabase(locals.runtime.env.DB),
      storage: await checkR2(locals.runtime.env.zserved_files),
      autorag: await checkAutoRAG(locals.runtime.env.LEGAL_RAG)
    }
  };

  const overallStatus = Object.values(health.services).every(s => s === 'healthy')
    ? 'healthy' : 'degraded';

  return new Response(JSON.stringify({ ...health, status: overallStatus }), {
    status: overallStatus === 'healthy' ? 200 : 503,
    headers: { 'Content-Type': 'application/json' }
  });
};

// Log security events
class SecurityLogger {
  static logFailedAuth(request: Request, reason: string) {
    console.warn(`Failed auth: ${request.headers.get('CF-Connecting-IP')} - ${reason}`);
  }

  static logSuspiciousActivity(request: Request, activity: string) {
    console.error(`Suspicious activity: ${request.url} - ${activity}`);
  }
}

// Implement rate limiting per tenant
class RateLimiter {
  static async checkLimit(tenantId: string, endpoint: string): Promise<boolean> {
    const key = `rate_limit:${tenantId}:${endpoint}`;
    const count = await env.KV.get(key);

    if (count && parseInt(count) > 100) {
      return false; // Rate limited
    }

    await env.KV.put(key, (parseInt(count || '0') + 1).toString(), { expirationTtl: 3600 });
    return true;
  }
}

// Track tenant usage for billing
class UsageTracker {
  static async recordUsage(tenantId: string, operation: string, cost: number) {
    const key = `usage:${tenantId}:${new Date().toISOString().slice(0, 7)}`;
    const current = await env.KV.get(key) || '0';
    await env.KV.put(key, (parseFloat(current) + cost).toString());
  }
}