| 1 | { |
| 2 | "$schema": "../../node_modules/wrangler/config-schema.json", |
| 3 | "name": "g1t-sudo", |
| 4 | "account_id": "1e6f2cffa3f445920836e8ebe446bb58", |
| 5 | "compatibility_date": "2026-09-26", |
| 6 | "placement": { "mode": "off" }, |
| 7 | "main": "./workers/app.ts", |
| 8 | // Staff only: reachable at sudo.g1t.sh, behind Cloudflare Access, and |
| 9 | // nowhere else. No workers.dev address and no preview URLs, so there is |
| 10 | // no way round Access to the worker. |
| 11 | "routes": [{ "pattern": "sudo.g1t.sh", "custom_domain": true }], |
| 12 | "workers_dev": false, |
| 13 | "preview_urls": false, |
| 14 | // Even the stylesheet goes through the worker, which checks the Access |
| 15 | // token on every request before anything is served. |
| 16 | "assets": { "binding": "ASSETS", "run_worker_first": true }, |
| 17 | // Billing's and identity's staff-only methods (admin_*). Nothing else |
| 18 | // binds to identity's admin_* methods. The event log, read-only, for |
| 19 | // `abuse.flagged` (Abuse & fraud). |
| 20 | "services": [ |
| 21 | { "binding": "BILLING", "service": "g1t-billing" }, |
| 22 | { "binding": "IDENTITY", "service": "g1t-identity" }, |
| 23 | { "binding": "EVENTS", "service": "g1t-events" }, |
| 24 | // The status page's staff-only entrypoint: posting incidents to |
| 25 | // status.g1t.sh (apps/status). Only bindings reach it. |
| 26 | { "binding": "STATUS", "service": "g1t-status", "entrypoint": "StatusAdmin" }, |
| 27 | // Suspending a workspace and cleaning up after abuse: its self-hosted |
| 28 | // runners (actions' admin_runners and admin_remove_runners), its |
| 29 | // projects, and their telemetry ingest tokens. |
| 30 | { "binding": "ACTIONS", "service": "g1t-actions" }, |
| 31 | { "binding": "PROJECTS", "service": "g1t-projects" }, |
| 32 | { "binding": "TELEMETRY", "service": "g1t-telemetry" } |
| 33 | ], |
| 34 | "vars": { |
| 35 | // The Zero Trust team domain, such as `g1t.cloudflareaccess.com`. |
| 36 | "ACCESS_TEAM_DOMAIN": "syntaqx.cloudflareaccess.com", |
| 37 | // The Access application's Audience (AUD) tag. |
| 38 | "ACCESS_AUD": "5479fcf84130fc7ae68c207ae69a81b2aa17d97714443c6f1dddd058c530b8cf", |
| 39 | // Who may use sudo, comma separated. Access lets them in; this |
| 40 | // decides again, in case the Access policy is ever widened. |
| 41 | "STAFF_EMAILS": "syntaqx@gmail.com, @g1t.sh", |
| 42 | // Access service tokens let in as staff: `<client id>=<name>`, comma |
| 43 | // separated. Each acts, and is recorded, as `<name>@service.g1t.sh`. |
| 44 | // The Access application needs a Service Auth policy including it. |
| 45 | "STAFF_SERVICE_TOKENS": "434297ede60761875e84742d0486cf27.access=claude" |
| 46 | }, |
| 47 | // Every log kept: staff only, few requests. |
| 48 | "observability": { "enabled": true, "head_sampling_rate": 1 }, |
| 49 | "upload_source_maps": true |
| 50 | } |