| 1 | { |
| 2 | "$schema": "../../node_modules/wrangler/config-schema.json", |
| 3 | "name": "g1t-billing", |
| 4 | "account_id": "1e6f2cffa3f445920836e8ebe446bb58", |
| 5 | "compatibility_date": "2026-09-26", |
| 6 | // Runs next to its database: a request makes several queries in turn, |
| 7 | // and each would otherwise cross the distance to it. |
| 8 | "placement": { "mode": "off" }, |
| 9 | "main": "build/index.js", |
| 10 | "build": { "command": "node ../../scripts/build-rust-worker.mjs" }, |
| 11 | // Reached only through service bindings. |
| 12 | "workers_dev": false, |
| 13 | "d1_databases": [ |
| 14 | { |
| 15 | "binding": "DB", |
| 16 | "database_name": "g1t-billing", |
| 17 | "database_id": "695a6979-fd07-4850-bc97-904a6b4b7a04", |
| 18 | "migrations_dir": "migrations" |
| 19 | } |
| 20 | ], |
| 21 | // Identity emails owners as their workspace nears its usage limit. |
| 22 | // Repos says which repositories are public (the open-source pool pays |
| 23 | // for work on those) and what private ones hold (the storage meter). |
| 24 | "services": [ |
| 25 | { "binding": "IDENTITY", "service": "g1t-identity" }, |
| 26 | { "binding": "REPOS", "service": "g1t-repos" }, |
| 27 | // What each workspace's packages hold, measured daily (src/storage.rs). |
| 28 | { "binding": "PACKAGES", "service": "g1t-packages" } |
| 29 | ], |
| 30 | // Margin alerts to staff (src/margin.rs), through Cloudflare Email |
| 31 | // Sending like identity's and the status page's mail. |
| 32 | "send_email": [{ "name": "EMAIL", "remote": true }], |
| 33 | // Events from the bus: a workspace renamed moves its billing to the |
| 34 | // new slug (src/rename.rs). |
| 35 | "queues": { |
| 36 | "consumers": [{ "queue": "g1t-events-billing", "max_batch_size": 20, "max_batch_timeout": 1, "max_retries": 3, "dead_letter_queue": "g1t-events-dlq" }] |
| 37 | }, |
| 38 | "vars": { |
| 39 | // What is added to what g1t runs at cost, in percent: g1t's overhead |
| 40 | // for running and building it. The price book's markups are the same. |
| 41 | "MARGIN_PERCENT": "20", |
| 42 | // While g1t is being built out, workspaces pay nothing: runs are |
| 43 | // recorded with what they cost, and nothing is charged. Set to |
| 44 | // "false" when pricing starts. |
| 45 | // Off: workspaces are charged as their account's terms say. g1t's own |
| 46 | // (flagon-io, Flagon, Inc.'s) is comped in sudo.g1t.sh, not by this switch. |
| 47 | "FREE_WHILE_BUILDING": "false", |
| 48 | // Whether g1t charges for usage at all (src/lib.rs, charging_from): |
| 49 | // "on" here. Every "is this charged" decision keys on it, not on |
| 50 | // whether STRIPE_SECRET_KEY is set: on and the key missing, usage is |
| 51 | // still recorded on the ledger and free workspaces are held to their |
| 52 | // limits (no Deployments, compute stops at the limit), so a lost |
| 53 | // secret fails closed. "off" (a self-hosted g1t without payments) |
| 54 | // gates and charges nothing. Unset, it follows whether the key is set. |
| 55 | "CHARGING": "on", |
| 56 | // The g1t plan (src/features.rs): $21 a month per workspace, never |
| 57 | // per person. It includes $10 of usage a month at cost plus 20%, used |
| 58 | // first and not rolled over; the other $10 pays for running g1t, the |
| 59 | // free forge for everyone, and the people building it. No quotas: |
| 60 | // builds, requests, CPU, custom domains, storage and git operations |
| 61 | // are all metered at cost plus 20% and drawn from the $10 first; only |
| 62 | // the workspace's spend limit stops it. Projects are not metered. |
| 63 | "PLAN_MONTHLY_CENTS": "2100", |
| 64 | "PLAN_INCLUDED_MICROS": "10000000", |
| 65 | // 1 GB of private storage free for every workspace: past it, the plan |
| 66 | // pays at cost plus the margin, and a free workspace's pushes to |
| 67 | // private repositories stop. |
| 68 | "FREE_PRIVATE_STORAGE_BYTES": "1000000000", |
| 69 | // What public and private packages may hold for free; past them a free |
| 70 | // workspace's pushes are refused, and the plan pays at cost plus the margin. |
| 71 | "PUBLIC_PACKAGES_FREE_BYTES": "10000000000", |
| 72 | "PRIVATE_PACKAGES_FREE_BYTES": "500000000", |
| 73 | // The audit log (src/retention.rs): 7 days for a free workspace, 90 on |
| 74 | // the plan, for g1t's own and for an enterprise. Staff can set an |
| 75 | // account's own days in sudo, up to AUDIT_MAX_DAYS; keep that at most |
| 76 | // the events service's AUDIT_MAX_DAYS, which deletes anything older. |
| 77 | "FREE_AUDIT_RETENTION_DAYS": "7", |
| 78 | "AUDIT_RETENTION_DAYS": "90", |
| 79 | "AUDIT_MAX_DAYS": "400", |
| 80 | // The trial (src/credits.rs, src/cards.rs): $5 of usage once per new |
| 81 | // workspace, granted after a card check (one per card), out of a pool |
| 82 | // for everyone ($100) that resets each calendar month (UTC). Either at |
| 83 | // 0 turns new trials off. Never for deployments. |
| 84 | "TRIAL_WORKSPACE_MICROS": "5000000", |
| 85 | "TRIAL_MONTHLY_POOL_MICROS": "100000000", |
| 86 | // g1t's open-source pool: checks, workflows and the merge queue on |
| 87 | // public repositories, for any workspace with a card check, up to $50 |
| 88 | // a month in all and $4 a month for any one repository: about 571 |
| 89 | // minutes of ubuntu-latest a repository, which is 4-core there. |
| 90 | "OSS_POOL_MICROS": "50000000", |
| 91 | "OSS_REPO_MICROS": "4000000", |
| 92 | // Ceilings on usage not yet paid for (src/limits.rs): $3 for a free |
| 93 | // workspace (it has no on-demand compute), $100 for a paid one's first |
| 94 | // month, then twice what it has paid as payments clear, between the |
| 95 | // start and $1,000 (Established: its monthly spend, up to $10,000). |
| 96 | "LIMIT_NEW_MICROS": "3000000", |
| 97 | "LIMIT_PAID_START_MICROS": "100000000", |
| 98 | "LIMIT_PAID_MIN_MICROS": "25000000", |
| 99 | "LIMIT_PAID_MAX_MICROS": "1000000000", |
| 100 | // A spike: an hour's spend above 5 times the usual hour over the last |
| 101 | // week, and at least $5, pauses new compute until an owner confirms. |
| 102 | "SPIKE_FACTOR": "5", |
| 103 | "SPIKE_FLOOR_MICROS": "5000000", |
| 104 | // The most of an overage's real cost a one-click goodwill credit |
| 105 | // covers (src/overages.rs); it always gives back the margin too. |
| 106 | "OVERAGE_FORGIVE_COST_MICROS": "50000000", |
| 107 | // Git operations through g1t (src/storage.rs): 50,000 a month free for |
| 108 | // every workspace; past it the plan pays at cost plus 20% and is never |
| 109 | // slowed, and a free workspace is slowed down by the repos service |
| 110 | // (its GIT_OPERATIONS_FREE_CAP, the same number), never charged. |
| 111 | "GIT_OPERATIONS_INCLUDED": "50000", |
| 112 | // A month's close charges no less than $5, so a payment's fee is never |
| 113 | // most of it: smaller amounts carry over. Charges at a limit always go |
| 114 | // through. |
| 115 | "MIN_CHARGE_MICROS": "5000000", |
| 116 | // Where the keeper reads what g1t pays (src/keeper.rs). Its token, |
| 117 | // CLOUDFLARE_USAGE_TOKEN, is a secret: Billing and Account |
| 118 | // Analytics, read only. The daily cost reconciliation |
| 119 | // (src/costs.rs, src/margin.rs) reads the bill with |
| 120 | // CLOUDFLARE_BILLING_TOKEN (Account: Billing Read, Account Analytics |
| 121 | // Read) when it is set, else with the usage token. With neither it |
| 122 | // reconciles only what g1t counted itself. |
| 123 | "CLOUDFLARE_ACCOUNT_ID": "1e6f2cffa3f445920836e8ebe446bb58", |
| 124 | // The day of the month the account's billing cycle starts on (Sep 28 |
| 125 | // to Oct 27): the usage bill's included amounts are a cycle's |
| 126 | // (src/cycle.rs). The subscriptions' read (current_period_start) |
| 127 | // takes over once it has worked. |
| 128 | "CLOUDFLARE_BILLING_DAY": "28", |
| 129 | // Where margin alerts go: a product or all of g1t under the margin |
| 130 | // floor, leaks, drift. Empty sends none (sudo still shows them). |
| 131 | "COSTS_ALERT_EMAIL": "hey@flagon.io", |
| 132 | // What g1t pays for itself, capped (src/budget.rs), at cost: |
| 133 | // a comped account's (flagon-io's) work, $150 a month, unless its |
| 134 | // terms in sudo set its own limit; alerts at 50, 75, 90 and 100% to |
| 135 | // COSTS_ALERT_EMAIL, and at 100% new work on it is refused. |
| 136 | "COMPED_MONTHLY_CEILING_MICROS": "150000000", |
| 137 | // All of g1t's own spend in a day (comped, the trial and open-source |
| 138 | // pools, free overruns, anything charged without real money): at |
| 139 | // $75, staff are emailed and can lift the breaker in sudo. Workspaces |
| 140 | // paying with real money are never paused. 0 turns either cap off. |
| 141 | "PLATFORM_DAILY_SPEND_CAP_MICROS": "75000000", |
| 142 | // The platform watch (src/platform.rs, and "Spend guardrails" in |
| 143 | // docs.g1t.sh/guides/deploy-to-cloudflare/): at |
| 144 | // a quarter past each hour, what Cloudflare counted in the hour |
| 145 | // before, per metric, against these thresholds. Each is a dollar or |
| 146 | // a few an hour at list prices, far above a small alpha's hour; 0 |
| 147 | // turns that metric's threshold off. Over one, staff are emailed |
| 148 | // (COSTS_ALERT_EMAIL, once per metric every 6 hours) and sudo shows |
| 149 | // it. |
| 150 | "PLATFORM_HOURLY_WORKERS_REQUESTS": "20000000", |
| 151 | "PLATFORM_HOURLY_WORKERS_CPU_MS": "100000000", |
| 152 | "PLATFORM_HOURLY_D1_ROWS_READ": "2000000000", |
| 153 | "PLATFORM_HOURLY_D1_ROWS_WRITTEN": "5000000", |
| 154 | "PLATFORM_HOURLY_QUEUE_OPERATIONS": "5000000", |
| 155 | "PLATFORM_HOURLY_DO_REQUESTS": "20000000", |
| 156 | "PLATFORM_HOURLY_DO_ROWS_WRITTEN": "5000000", |
| 157 | "PLATFORM_HOURLY_DO_STORAGE_WRITE_UNITS": "5000000", |
| 158 | "PLATFORM_HOURLY_DO_ACTIVE_SECONDS": "3000000", |
| 159 | "PLATFORM_HOURLY_KV_READS": "10000000", |
| 160 | "PLATFORM_HOURLY_KV_WRITES": "200000", |
| 161 | "PLATFORM_HOURLY_KV_DELETES": "200000", |
| 162 | "PLATFORM_HOURLY_KV_LISTS": "200000", |
| 163 | "PLATFORM_HOURLY_ARTIFACTS_EVENTS": "1000000", |
| 164 | // A spike: an hour over 10 times the last week's median hour, and at |
| 165 | // least 10% of its threshold. Emailed, never paused by itself. |
| 166 | "PLATFORM_SPIKE_FACTOR": "10", |
| 167 | "PLATFORM_SPIKE_FLOOR_PERCENT": "10", |
| 168 | // Severe: 5 times a threshold pauses the levels that metric feeds, |
| 169 | // of those AUTO_PAUSE names (compute, schedules, indexing, renders; |
| 170 | // comma-separated, empty for none). Staff resume them in sudo. |
| 171 | "PLATFORM_SEVERE_FACTOR": "5", |
| 172 | "AUTO_PAUSE": "schedules,indexing", |
| 173 | // Cloudflare's fixed subscriptions a month, for sudo's figures only: |
| 174 | // Workers Paid ($5) and Workers for Platforms ($25). |
| 175 | "CLOUDFLARE_FIXED_MONTHLY_MICROS": "30000000" |
| 176 | }, |
| 177 | // The tick every 15 minutes (Stripe, autopay, closing months), which at |
| 178 | // a quarter past each hour also runs the platform watch; checking costs |
| 179 | // daily (keeper::DAILY). |
| 180 | "triggers": { "crons": ["*/15 * * * *", "17 4 * * *"] }, |
| 181 | // Secrets: STRIPE_SECRET_KEY. Without it nothing can be paid; whether |
| 182 | // usage is charged is CHARGING's to say. |
| 183 | // STRIPE_WEBHOOK_SECRET: the signing secret (whsec_…) of the destination |
| 184 | // made in Stripe's dashboard for https://api.g1t.sh/stripe/webhook. |
| 185 | // Without it every event is refused (the replay still reads them). |
| 186 | // BILLING_KEY: 64 hex characters (openssl rand -hex 32), which seals the |
| 187 | // AI providers' admin keys workspaces connect for their cost reports |
| 188 | // (src/provider_costs.rs). Without it none can be connected; changing it |
| 189 | // means every provider has to be connected again. |
| 190 | // Every log kept: money moves here, and every failure matters. |
| 191 | "observability": { "enabled": true, "head_sampling_rate": 1 } |
| 192 | } |