| 1 | { |
| 2 | "$schema": "../../node_modules/wrangler/config-schema.json", |
| 3 | "name": "g1t-sudo", |
| 4 | "account_id": "1e6f2cffa3f445920836e8ebe446bb58", |
| 5 | "compatibility_date": "2026-09-26", |
| 6 | "main": "./workers/app.ts", |
| 7 | // Staff only: reachable at sudo.g1t.sh, behind Cloudflare Access, and |
| 8 | // nowhere else. No workers.dev address and no preview URLs, so there is |
| 9 | // no way round Access to the worker. |
| 10 | "routes": [{ "pattern": "sudo.g1t.sh", "custom_domain": true }], |
| 11 | "workers_dev": false, |
| 12 | "preview_urls": false, |
| 13 | // Even the stylesheet goes through the worker, which checks the Access |
| 14 | // token on every request before anything is served. |
| 15 | "assets": { "binding": "ASSETS", "run_worker_first": true }, |
| 16 | // Billing's and identity's staff-only methods (admin_*). Nothing else |
| 17 | // binds to identity's admin_* methods. The event log, read-only, for |
| 18 | // `abuse.flagged` (Abuse & fraud). |
| 19 | "services": [ |
| 20 | { "binding": "BILLING", "service": "g1t-billing" }, |
| 21 | { "binding": "IDENTITY", "service": "g1t-identity" }, |
| 22 | { "binding": "EVENTS", "service": "g1t-events" } |
| 23 | ], |
| 24 | "vars": { |
| 25 | // The Zero Trust team domain, such as `g1t.cloudflareaccess.com`. |
| 26 | "ACCESS_TEAM_DOMAIN": "syntaqx.cloudflareaccess.com", |
| 27 | // The Access application's Audience (AUD) tag. |
| 28 | "ACCESS_AUD": "5479fcf84130fc7ae68c207ae69a81b2aa17d97714443c6f1dddd058c530b8cf", |
| 29 | // Who may use sudo, comma separated. Access lets them in; this |
| 30 | // decides again, in case the Access policy is ever widened. |
| 31 | "STAFF_EMAILS": "syntaqx@gmail.com, @g1t.sh" |
| 32 | }, |
| 33 | "observability": { "enabled": true }, |
| 34 | "upload_source_maps": true |
| 35 | } |