| 1 | { |
| 2 | "$schema": "../../node_modules/wrangler/config-schema.json", |
| 3 | "name": "g1t-identity", |
| 4 | "account_id": "1e6f2cffa3f445920836e8ebe446bb58", |
| 5 | "compatibility_date": "2026-09-26", |
| 6 | // Runs next to its database: a request makes several queries in turn, |
| 7 | // and each would otherwise cross the distance to it. |
| 8 | "placement": { "mode": "off" }, |
| 9 | "main": "build/index.js", |
| 10 | // Purging deleted workspaces and accounts once their restore window |
| 11 | // passes (src/lib.rs `scheduled`). |
| 12 | "triggers": { "crons": ["*/15 * * * *"] }, |
| 13 | "build": { "command": "node ../../scripts/build-rust-worker.mjs" }, |
| 14 | // Reached only through service bindings. |
| 15 | "workers_dev": false, |
| 16 | "d1_databases": [ |
| 17 | { |
| 18 | "binding": "DB", |
| 19 | "database_name": "g1t", |
| 20 | "database_id": "b7d49c93-2666-4006-a3c3-073a01838dc9", |
| 21 | "migrations_dir": "migrations" |
| 22 | } |
| 23 | ], |
| 24 | "send_email": [{ "name": "EMAIL", "remote": true }], |
| 25 | // Uploaded avatars, keyed by the SHA-256 of their bytes. Only this |
| 26 | // service writes them; the site reads them to serve /avatars/<hash>. |
| 27 | "kv_namespaces": [{ "binding": "AVATARS", "id": "e627b571f07047e187c03e1fc2b3bbdd" }], |
| 28 | // Renaming a workspace publishes workspace.renamed, so every service |
| 29 | // moves what it keeps under the old slug. |
| 30 | "services": [ |
| 31 | { "binding": "EVENTS", "service": "g1t-events" }, |
| 32 | { "binding": "CHAT", "service": "g1t-chat" }, |
| 33 | { "binding": "NOTIFY", "service": "g1t-notify" }, |
| 34 | { "binding": "ARTIFACTS", "service": "g1t-artifacts" }, |
| 35 | // Deleting a workspace counts what goes with it, and has billing |
| 36 | // settle it first; staff restores and purges are recorded in sudo's |
| 37 | // audit log, which billing keeps (src/deletion.rs). |
| 38 | { "binding": "REPOS", "service": "g1t-repos" }, |
| 39 | { "binding": "PROJECTS", "service": "g1t-projects" }, |
| 40 | { "binding": "BILLING", "service": "g1t-billing" } |
| 41 | ], |
| 42 | // Signing in with GitHub (src/github.rs), through g1t's GitHub App. |
| 43 | // Its client ID is public. Secrets: GITHUB_APP_CLIENT_SECRET, the app's |
| 44 | // client secret, and IDENTITY_KEY, 64 hex characters, which seals the |
| 45 | // GitHub user tokens kept for each linked account. Without the client ID |
| 46 | // and secret, nobody is offered GitHub sign-in. |
| 47 | // |
| 48 | // Invites (src/invites.rs): anyone may register. An invitation sent to |
| 49 | // an address without an account carries an invite code, working |
| 50 | // INVITE_TTL_DAYS. IDENTITY_KEY also seals invite codes so their makers |
| 51 | // can copy them again. Each person may invite INVITES_PER_USER friends |
| 52 | // to g1t by email (src/invites/friends.rs); that invite is never needed |
| 53 | // to sign up. |
| 54 | // |
| 55 | // PROTECTED_WORKSPACES: workspaces nobody can ever delete, by owner, |
| 56 | // token or staff, as comma-separated slugs or workspace ids. flagon-io |
| 57 | // is protected whatever this says (src/deletion.rs). |
| 58 | // |
| 59 | // PROTECTED_ACCOUNTS: accounts nobody can ever delete, by the person or |
| 60 | // staff, as comma-separated usernames or user ids. g1t, g1t-agent and |
| 61 | // ghost are protected whatever this says (src/account_deletion.rs). |
| 62 | "vars": { |
| 63 | "PROTECTED_WORKSPACES": "flagon-io", |
| 64 | "PROTECTED_ACCOUNTS": "", |
| 65 | "GITHUB_APP_CLIENT_ID": "Iv23liZS94alfjIUn1eW", |
| 66 | "INVITE_TTL_DAYS": "30", |
| 67 | "INVITES_PER_USER": "20" |
| 68 | }, |
| 69 | // Every log kept: sign-ins and tokens, where every failure matters. |
| 70 | "observability": { "enabled": true, "head_sampling_rate": 1 } |
| 71 | } |