Pick any line to see why it is the way it is: the commit, the pull request and issue it came from, and what the agent was thinking.
| Checkout tries a failed fetch twice more, after 2 s and 5 s | 1 | // Everything g1t deploys to Cloudflare, in one place. Read by |
| 2 | // scripts/deploy.mjs (plan, deploy), deploy/self-host/configs.mjs (what a | |
| 3 | // self-hosted installation runs) and the tests in scripts/deploy/. | |
| The docs folder is gone, and what it held lives where people read it: how a self-hosted g1t runs and how to deploy g1t to Cloudflare are pages on docs.g1t.sh under Run g1t yourself, and speed, rate limits and operating g1t.sh are sections of CONTRIBUTING.md; code that cited a file in docs/ now points to the page or section that covers it, or says what it means itself, and applied migrations and the runner images are left as they were. | 4 | // docs.g1t.sh/guides/deploy-to-cloudflare/ explains each field and how to |
| 5 | // add a unit. | |
| Checkout tries a failed fetch twice more, after 2 s and 5 s | 6 | // |
| 7 | // What is written here is what the Wrangler configs cannot say. The rest is | |
| 8 | // read from each unit's wrangler.jsonc, never copied: its D1 databases and | |
| 9 | // migrations, the services it binds to, its KV, R2, queues and routes. The | |
| 10 | // shared crates and packages a unit is built from are read from Cargo's and | |
| 11 | // npm's workspace metadata. `worker` and `d1` are written here too, so the | |
| 12 | // file reads as an inventory, and a test checks they match the configs. | |
| 13 | { | |
| 14 | // Deployed in this order. A stage starts only when the one before it | |
| 15 | // succeeded. A unit binds only to units in its own stage or an earlier | |
| 16 | // one (a test checks it), so new code never calls a service that has | |
| 17 | // not shipped yet. Within a stage, units go out in parallel. | |
| 18 | // | |
| 19 | // migrations: every pending D1 migration, before any code. | |
| 20 | // core: the services, reached through service bindings. | |
| The agents, models and context services are deleted. Nothing calls them any more: workspace agents, the hosted model proxy at models.g1t.sh with its AI Gateway, and the context hub with its search index are gone with the features they served. The deploy stack no longer builds or deploys them, so it no longer needs CONNECTORS_KEY, AI_GATEWAY_TOKEN, ANTHROPIC_API_KEY or WORKERS_AI_TOKEN, and a self-hosted install no longer generates CONNECTORS_KEY or stubs them out. Their databases, queues, index, gateway and domain stay in Cloudflare until they are deleted by hand after this is deployed. | 21 | // edge: public endpoints other than the site: API, MCP, g1t.page, status. |
| Checkout tries a failed fetch twice more, after 2 s and 5 s | 22 | // front: the site, sudo and the docs. |
| 23 | "stages": ["migrations", "core", "edge", "front"], | |
| 24 | ||
| 25 | // Names for the resources the configs refer to by id, for setup | |
| 26 | // commands and the docs. A test checks every KV id in a config is here. | |
| 27 | "resources": { | |
| 28 | "kv": { | |
| 29 | "16a4232cb746418db53782aa068be693": "g1t-actions-blobs", | |
| 30 | "e627b571f07047e187c03e1fc2b3bbdd": "g1t-avatars", | |
| 31 | "14bc5c233d4c46a5bbf23b5367cce5fd": "g1t-domains", | |
| 32 | "be765052d0124c2a935b3db4dff99f1f": "g1t-repos-git-cache" | |
| 33 | } | |
| 34 | }, | |
| 35 | ||
| 36 | // Each deployable unit, by short name (`--only events,web`). | |
| 37 | // | |
| 38 | // kind: rust-worker (worker-build), ts-worker (Wrangler bundles it), | |
| 39 | // react-router (vite build first), astro (astro build first). | |
| 40 | // secrets: names only; set with `npx wrangler secret put NAME` in its folder. | |
| 41 | // setup: one-time steps no config can say, for a first deploy. | |
| 42 | // self_host: what deploy/self-host does with it: "run" (in the one | |
| 43 | // workerd), "off" (bound to the off Worker), "separate" (a | |
| 44 | // process of its own), or "none". | |
| 45 | // inputs: files outside its folder it is built from that no workspace | |
| 46 | // metadata names (a test finds such imports). | |
| The docs folder is gone, and what it held lives where people read it: how a self-hosted g1t runs and how to deploy g1t to Cloudflare are pages on docs.g1t.sh under Run g1t yourself, and speed, rate limits and operating g1t.sh are sections of CONTRIBUTING.md; code that cited a file in docs/ now points to the page or section that covers it, or says what it means itself, and applied migrations and the runner images are left as they were. | 47 | // image: a Containers image (the guide's "The runner's images"): |
| Checkout tries a failed fetch twice more, after 2 s and 5 s | 48 | // dockerfile the image a deploy ships: the base plus the binary |
| 49 | // crate the crate that binary is built from (and what it uses) | |
| 50 | // base { context: the base's folder, lock: the file that | |
| 51 | // records the base that was pushed }; the base is | |
| 52 | // rebuilt only when its folder changes | |
| 53 | // repository where both are pushed in Cloudflare's registry | |
| 54 | "units": { | |
| 55 | "events": { | |
| 56 | "path": "services/events", | |
| 57 | "kind": "rust-worker", | |
| 58 | "worker": "g1t-events", | |
| 59 | "d1": { "database": "g1t-events", "migrations": "migrations" }, | |
| 60 | "stage": "core", | |
| 61 | "secrets": [], | |
| Merge branch 'worktree-agent-ad8a36dfcd4176015' into spend-guardrails | 62 | "setup": [ |
| 63 | "The dead-letter queue every queue consumer sends what it gave up on to, before any unit that names it deploys: npx wrangler queues create g1t-events-dlq" | |
| 64 | ], | |
| Checkout tries a failed fetch twice more, after 2 s and 5 s | 65 | "self_host": "run" |
| 66 | }, | |
| 67 | "identity": { | |
| 68 | "path": "services/identity", | |
| 69 | "kind": "rust-worker", | |
| 70 | "worker": "g1t-identity", | |
| 71 | "d1": { "database": "g1t", "migrations": "migrations" }, | |
| 72 | "stage": "core", | |
| 73 | "secrets": ["GITHUB_APP_CLIENT_SECRET", "IDENTITY_KEY"], | |
| 74 | "setup": ["Email Sending on g1t.sh (the EMAIL binding)"], | |
| 75 | "self_host": "run" | |
| 76 | }, | |
| 77 | "repos": { | |
| 78 | "path": "services/repos", | |
| 79 | "kind": "rust-worker", | |
| 80 | "worker": "g1t-repos", | |
| 81 | "d1": { "database": "g1t-repos", "migrations": "migrations" }, | |
| 82 | "stage": "core", | |
| Merge GitHub pull request #8 (claude/cool-newton-7nm8r9): Docker deployments on g1t.page behind a switch that stays off until Cloudflare's container APIs are checked live, workflows a workspace manages in its repositories, tarball and zipball downloads, refs/pull/* kept to g1t alone, framework detection for g1t.page builds, and a workflow's event payload matching GitHub's. | 83 | // REPOS_KEY seals what its isolates share (src/shared.rs) and the |
| 84 | // API's tarball and zipball links (src/archive_links.rs), which | |
| 85 | // fail without it. | |
| Checkout tries a failed fetch twice more, after 2 s and 5 s | 86 | "secrets": ["REPOS_KEY"], |
| 87 | "setup": [ | |
| 88 | "The Artifacts namespace `g1t` (the ARTIFACTS binding)", | |
| Merge branch 'worktree-agent-ac5b181a013e54348' | 89 | "The R2 bucket `g1t-git-packs` (GIT_PACKS) with its lifecycle rule: `npx wrangler r2 bucket create g1t-git-packs`, then `npx wrangler r2 bucket lifecycle add g1t-git-packs expire-packs packs/ --expire-days 7 --abort-multipart-days 1`", |
| 90 | "The R2 bucket for nightly backups: npx wrangler r2 bucket create g1t-backups" | |
| Checkout tries a failed fetch twice more, after 2 s and 5 s | 91 | ], |
| 92 | "self_host": "run" | |
| 93 | }, | |
| 94 | "work": { | |
| 95 | "path": "services/work", | |
| 96 | "kind": "rust-worker", | |
| 97 | "worker": "g1t-work", | |
| 98 | "d1": { "database": "g1t-work", "migrations": "migrations" }, | |
| 99 | "stage": "core", | |
| 100 | "secrets": [], | |
| 101 | "self_host": "run" | |
| 102 | }, | |
| 103 | "search": { | |
| 104 | "path": "services/search", | |
| 105 | "kind": "rust-worker", | |
| 106 | "worker": "g1t-search", | |
| 107 | "d1": { "database": "g1t-search", "migrations": "migrations" }, | |
| 108 | "stage": "core", | |
| 109 | "secrets": [], | |
| 110 | "self_host": "run" | |
| 111 | }, | |
| 112 | "projects": { | |
| 113 | "path": "services/projects", | |
| 114 | "kind": "ts-worker", | |
| 115 | "worker": "g1t-projects", | |
| 116 | "d1": { "database": "g1t-projects", "migrations": "migrations" }, | |
| 117 | "stage": "core", | |
| 118 | "secrets": [], | |
| 119 | "self_host": "run" | |
| 120 | }, | |
| Chat and workspace agents: channels, DMs and named agents you talk to | 121 | "chat": { |
| 122 | "path": "services/chat", | |
| 123 | "kind": "ts-worker", | |
| 124 | "worker": "g1t-chat", | |
| 125 | "d1": { "database": "g1t-chat", "migrations": "migrations" }, | |
| 126 | "stage": "core", | |
| 127 | "secrets": [], | |
| 128 | "setup": [ | |
| 129 | "The D1 database, before the first deploy: npx wrangler d1 create g1t-chat, then put its id in services/chat/wrangler.jsonc" | |
| 130 | ], | |
| 131 | "self_host": "run" | |
| 132 | }, | |
| The artifacts service is services/artifacts, the Worker g1t-artifacts, bound as ARTIFACTS by the API, the site and the agents; its live rooms move to it with a Durable Object transfer from g1t-docs-service, and its database, bucket, indexes and queue keep their names. The git store's binding and settings are GITSTORE, its ops scripts gitstore-*, and workflow run artifacts keep their compatible API under run_artifacts modules. The deploy tool puts a Worker that has never deployed before the Workers in its stage that bind to it, and the deploy guide gives the cutover runbook. | 133 | // Artifacts: docs (a doc is one kind of artifact), their spaces, |
| 134 | // sharing and live rooms. It was g1t-docs-service (services/docs) | |
| 135 | // until 2026-10; its resources kept their g1t-docs names. g1t-docs | |
| 136 | // is the documentation site (apps/docs). | |
| 137 | "artifacts": { | |
| 138 | "path": "services/artifacts", | |
| Docs: a workspace knowledge base people and agents write together | 139 | "kind": "ts-worker", |
| The artifacts service is services/artifacts, the Worker g1t-artifacts, bound as ARTIFACTS by the API, the site and the agents; its live rooms move to it with a Durable Object transfer from g1t-docs-service, and its database, bucket, indexes and queue keep their names. The git store's binding and settings are GITSTORE, its ops scripts gitstore-*, and workflow run artifacts keep their compatible API under run_artifacts modules. The deploy tool puts a Worker that has never deployed before the Workers in its stage that bind to it, and the deploy guide gives the cutover runbook. | 140 | "worker": "g1t-artifacts", |
| Docs: a workspace knowledge base people and agents write together | 141 | "d1": { "database": "g1t-docs", "migrations": "migrations" }, |
| 142 | "stage": "core", | |
| 143 | "secrets": [], | |
| 144 | "setup": [ | |
| The artifacts service is services/artifacts, the Worker g1t-artifacts, bound as ARTIFACTS by the API, the site and the agents; its live rooms move to it with a Durable Object transfer from g1t-docs-service, and its database, bucket, indexes and queue keep their names. The git store's binding and settings are GITSTORE, its ops scripts gitstore-*, and workflow run artifacts keep their compatible API under run_artifacts modules. The deploy tool puts a Worker that has never deployed before the Workers in its stage that bind to it, and the deploy guide gives the cutover runbook. | 145 | "An installation that ran g1t-docs-service: move to g1t-artifacts as \"Renaming a Worker\" in docs.g1t.sh/guides/deploy-to-cloudflare/ says (its queue consumer first, then this Worker, which takes the old Worker's live rooms)", |
| 146 | "The D1 database, before the first deploy: npx wrangler d1 create g1t-docs, then put its id in services/artifacts/wrangler.jsonc", | |
| Docs know what code they describe; a project's docs folder in Docs; Docs events; files on any S3 store | 147 | "The R2 bucket for files in pages: npx wrangler r2 bucket create g1t-docs-files", |
| Docs index by meaning: passages of every page and project doc, embedded on save and recalled for agents; hybrid search for people | 148 | "The queue the events service sends it merges and pushes on (pages whose cited code changed, projects' docs): npx wrangler queues create g1t-events-docs. The service also sends its own backfill jobs to it (JOBS)", |
| The agents, models and context services are deleted. Nothing calls them any more: workspace agents, the hosted model proxy at models.g1t.sh with its AI Gateway, and the context hub with its search index are gone with the features they served. The deploy stack no longer builds or deploys them, so it no longer needs CONNECTORS_KEY, AI_GATEWAY_TOKEN, ANTHROPIC_API_KEY or WORKERS_AI_TOKEN, and a self-hosted install no longer generates CONNECTORS_KEY or stubs them out. Their databases, queues, index, gateway and domain stay in Cloudflare until they are deleted by hand after this is deployed. | 149 | "The Vectorize index Docs are searched by meaning from: npx wrangler vectorize create g1t-docs --dimensions=768 --metric=cosine, with string metadata indexes on workspace_id and space_id (npx wrangler vectorize create-metadata-index g1t-docs --property-name=<name> --type=string)", |
| 150 | "The Vectorize index for artifacts (folios), before the first deploy with FOLIO_VECTORS: npx wrangler vectorize create g1t-folios --dimensions=768 --metric=cosine, with string metadata indexes on workspace_id, scope and kind (npx wrangler vectorize create-metadata-index g1t-folios --property-name=<name> --type=string). Without it, artifacts are searched by words" | |
| Docs: a workspace knowledge base people and agents write together | 151 | ], |
| 152 | "self_host": "run" | |
| 153 | }, | |
| Projects have Observability: their requests, logs, traces, metrics and errors, from apps on g1t.page with nothing to set up, and from software anywhere else over OpenTelemetry. | 154 | "telemetry": { |
| 155 | "path": "services/telemetry", | |
| 156 | "kind": "ts-worker", | |
| 157 | "worker": "g1t-telemetry", | |
| 158 | // No D1: each project's telemetry is kept in its own Durable | |
| 159 | // Object's SQLite storage. Public at otel.g1t.sh (OTLP), and | |
| 160 | // every app on g1t.page names it as its Tail Worker. | |
| 161 | "stage": "core", | |
| 162 | // CLOUDFLARE_EXPORT_KEY is optional (Cloudflare's own OpenTelemetry | |
| 163 | // export of the apps), so it is not listed. | |
| 164 | "secrets": [], | |
| 165 | "setup": [ | |
| 166 | "Deployed once before the deployments service and the dispatcher, which name it (`node scripts/deploy.mjs deploy --only telemetry`): a binding or Tail Worker that names a Worker not yet there is refused" | |
| 167 | ], | |
| 168 | "self_host": "run" | |
| 169 | }, | |
| Merge the workspace shell: navigation and phone shell, g1t as orchestrator, agents in roles with audience-checked reads, reactions and custom emoji, live notifications and browser push, the homepage tour (agents 0002, chat 0002) | 170 | "notify": { |
| 171 | "path": "services/notify", | |
| 172 | "kind": "ts-worker", | |
| 173 | "worker": "g1t-notify", | |
| 174 | // No D1: each person's feed keeps its own state in its Durable | |
| 175 | // Object's SQLite storage. | |
| 176 | "stage": "core", | |
| 177 | // The private half of the VAPID key pair browser pushes are signed | |
| 178 | // with; without it, notifications are live in open tabs only. | |
| The phone app: Chat in full with phone notifications, plus Code and Customize (#4) | 179 | // EXPO_ACCESS_TOKEN, for pushes to the phone app, is optional |
| 180 | // (only for an Expo project with enhanced push security), so it | |
| 181 | // is not listed. | |
| Merge the workspace shell: navigation and phone shell, g1t as orchestrator, agents in roles with audience-checked reads, reactions and custom emoji, live notifications and browser push, the homepage tour (agents 0002, chat 0002) | 182 | "secrets": ["VAPID_PRIVATE_KEY"], |
| 183 | "setup": [ | |
| 184 | "The VAPID key pair for browser push: `node scripts/ops/vapid-keys.mjs` prints both halves and stores nothing. Put the public half in VAPID_PUBLIC_KEY in services/notify/wrangler.jsonc, and the private half with `npx wrangler secret put VAPID_PRIVATE_KEY` in services/notify" | |
| 185 | ], | |
| 186 | "self_host": "run" | |
| 187 | }, | |
| Checkout tries a failed fetch twice more, after 2 s and 5 s | 188 | "billing": { |
| 189 | "path": "services/billing", | |
| 190 | "kind": "rust-worker", | |
| 191 | "worker": "g1t-billing", | |
| 192 | "d1": { "database": "g1t-billing", "migrations": "migrations" }, | |
| 193 | "stage": "core", | |
| 194 | "secrets": ["STRIPE_SECRET_KEY", "STRIPE_WEBHOOK_SECRET", "CLOUDFLARE_USAGE_TOKEN"], | |
| 195 | "self_host": "run" | |
| 196 | }, | |
| 197 | "integrations": { | |
| 198 | "path": "services/integrations", | |
| 199 | "kind": "rust-worker", | |
| 200 | "worker": "g1t-integrations", | |
| 201 | "d1": { "database": "g1t-integrations", "migrations": "migrations" }, | |
| 202 | "stage": "core", | |
| 203 | "secrets": ["INTEGRATIONS_KEY", "GITHUB_APP_PRIVATE_KEY", "GITHUB_APP_WEBHOOK_SECRET"], | |
| 204 | "self_host": "run" | |
| 205 | }, | |
| 206 | "webhooks": { | |
| 207 | "path": "services/webhooks", | |
| 208 | "kind": "rust-worker", | |
| 209 | "worker": "g1t-webhooks", | |
| 210 | "d1": { "database": "g1t-webhooks", "migrations": "migrations" }, | |
| 211 | "stage": "core", | |
| 212 | "secrets": ["WEBHOOKS_KEY"], | |
| 213 | "self_host": "run" | |
| 214 | }, | |
| 215 | "actions": { | |
| 216 | "path": "services/actions", | |
| 217 | "kind": "rust-worker", | |
| 218 | "worker": "g1t-actions", | |
| 219 | "d1": { "database": "g1t-actions", "migrations": "migrations" }, | |
| 220 | "stage": "core", | |
| 221 | "secrets": ["ACTIONS_KEY"], | |
| 222 | "self_host": "run" | |
| 223 | }, | |
| 224 | "packages": { | |
| 225 | "path": "services/packages", | |
| 226 | "kind": "rust-worker", | |
| 227 | "worker": "g1t-packages", | |
| 228 | "d1": { "database": "g1t-packages", "migrations": "migrations" }, | |
| 229 | "stage": "core", | |
| 230 | "secrets": ["PACKAGES_TOKEN_SECRET", "R2_ACCESS_KEY_ID", "R2_SECRET_ACCESS_KEY"], | |
| 231 | "setup": [ | |
| 232 | "The D1 database: npx wrangler d1 create g1t-packages, its id in services/packages/wrangler.jsonc", | |
| 233 | "The R2 bucket for packages' files: npx wrangler r2 bucket create g1t-packages", | |
| 234 | "The events queue: npx wrangler queues create g1t-events-packages", | |
| 235 | "For signed downloads: an R2 API token with read access to g1t-packages, as R2_ACCESS_KEY_ID and R2_SECRET_ACCESS_KEY" | |
| 236 | ], | |
| 237 | "self_host": "run" | |
| 238 | }, | |
| 239 | "security": { | |
| 240 | "path": "services/security", | |
| 241 | "kind": "rust-worker", | |
| 242 | "worker": "g1t-security", | |
| 243 | "d1": { "database": "g1t-security", "migrations": "migrations" }, | |
| 244 | "stage": "core", | |
| 245 | "secrets": [], | |
| 246 | "self_host": "run" | |
| 247 | }, | |
| 248 | "deployments": { | |
| 249 | "path": "services/deployments", | |
| 250 | "kind": "ts-worker", | |
| 251 | "worker": "g1t-deployments", | |
| 252 | "d1": { "database": "g1t-deployments", "migrations": "migrations" }, | |
| 253 | "stage": "core", | |
| 254 | "secrets": ["CLOUDFLARE_API_TOKEN"], | |
| 255 | "setup": [ | |
| 256 | "Workers for Platforms, and the dispatch namespace: scripts/setup-deployments.sh", | |
| 257 | "Custom domains (Cloudflare for SaaS on g1t.page): scripts/setup-custom-domains.sh" | |
| 258 | ], | |
| 259 | "self_host": "run" | |
| 260 | }, | |
| 261 | "runner": { | |
| 262 | "path": "services/runner", | |
| 263 | "kind": "ts-worker", | |
| 264 | "worker": "g1t-runner", | |
| 265 | "stage": "core", | |
| The agents, models and context services are deleted. Nothing calls them any more: workspace agents, the hosted model proxy at models.g1t.sh with its AI Gateway, and the context hub with its search index are gone with the features they served. The deploy stack no longer builds or deploys them, so it no longer needs CONNECTORS_KEY, AI_GATEWAY_TOKEN, ANTHROPIC_API_KEY or WORKERS_AI_TOKEN, and a self-hosted install no longer generates CONNECTORS_KEY or stubs them out. Their databases, queues, index, gateway and domain stay in Cloudflare until they are deleted by hand after this is deployed. | 266 | "secrets": [], |
| Checkout tries a failed fetch twice more, after 2 s and 5 s | 267 | "setup": [ |
| 268 | "Containers on the account; Docker on the machine that builds a new image", | |
| 269 | "The base image, once: node scripts/deploy.mjs build-base" | |
| 270 | ], | |
| 271 | "image": { | |
| 272 | "dockerfile": "services/runner/Dockerfile", | |
| 273 | // The binary the image adds to its base (scripts/build-runner.mjs). | |
| 274 | "crate": "g1t-runner", | |
| 275 | "base": { "context": "services/runner/base", "lock": "services/runner/base.json" }, | |
| 276 | "repository": "g1t-runner" | |
| 277 | }, | |
| 278 | "self_host": "off" | |
| 279 | }, | |
| 280 | "og": { | |
| 281 | "path": "services/og", | |
| 282 | "kind": "ts-worker", | |
| 283 | "worker": "g1t-og", | |
| 284 | "stage": "core", | |
| 285 | "secrets": [], | |
| 286 | "setup": ["Browser Rendering on the account (the BROWSER binding)"], | |
| 287 | // The roadmap cards read the site's roadmap. | |
| 288 | "inputs": ["apps/web/app/lib/roadmap.ts"], | |
| 289 | "self_host": "none" | |
| 290 | }, | |
| 291 | "api": { | |
| 292 | "path": "apps/api", | |
| 293 | "kind": "rust-worker", | |
| 294 | "worker": "g1t-api", | |
| 295 | "stage": "edge", | |
| Actions: OIDC tokens, the toolkit's cache and artifact services, and artifacts in R2 | 296 | // ACTIONS_OIDC_KEY signs workflow jobs' OIDC tokens; without it the |
| 297 | // issuer answers 404 and jobs are not offered tokens. | |
| The docs folder is gone, and what it held lives where people read it: how a self-hosted g1t runs and how to deploy g1t to Cloudflare are pages on docs.g1t.sh under Run g1t yourself, and speed, rate limits and operating g1t.sh are sections of CONTRIBUTING.md; code that cited a file in docs/ now points to the page or section that covers it, or says what it means itself, and applied migrations and the runner images are left as they were. | 298 | // ACTIONS_OIDC_KEY_PREVIOUS only while rotating (the guide's "OIDC |
| 299 | // tokens for workflow jobs"). | |
| Actions: OIDC tokens, the toolkit's cache and artifact services, and artifacts in R2 | 300 | "secrets": ["ACTIONS_OIDC_KEY"], |
| 301 | "setup": [ | |
| The docs folder is gone, and what it held lives where people read it: how a self-hosted g1t runs and how to deploy g1t to Cloudflare are pages on docs.g1t.sh under Run g1t yourself, and speed, rate limits and operating g1t.sh are sections of CONTRIBUTING.md; code that cited a file in docs/ now points to the page or section that covers it, or says what it means itself, and applied migrations and the runner images are left as they were. | 302 | "The OIDC signing key for workflow jobs: an RSA key made with `openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048`, stored with `npx wrangler secret put ACTIONS_OIDC_KEY` (docs.g1t.sh/guides/deploy-to-cloudflare/#oidc-tokens-for-workflow-jobs)", |
| 303 | "The actions cache bucket's lifecycle rule limited to `c/`, so artifacts under `a/` are kept their retention-days (docs.g1t.sh/guides/deploy-to-cloudflare/#a-first-deploy-to-a-new-account)" | |
| Actions: OIDC tokens, the toolkit's cache and artifact services, and artifacts in R2 | 304 | ], |
| Merge branch 'worktree-agent-aaf03bdceac799c89' | 305 | "self_host": "separate" |
| Checkout tries a failed fetch twice more, after 2 s and 5 s | 306 | }, |
| 307 | "pages": { | |
| 308 | "path": "services/pages", | |
| 309 | "kind": "ts-worker", | |
| 310 | "worker": "g1t-pages", | |
| 311 | "stage": "edge", | |
| 312 | "secrets": [], | |
| 313 | "setup": ["A proxied wildcard DNS record on g1t.page (`*`, AAAA 100::): scripts/setup-deployments.sh"], | |
| 314 | "self_host": "none" | |
| 315 | }, | |
| 316 | "status": { | |
| 317 | "path": "apps/status", | |
| 318 | "kind": "ts-worker", | |
| 319 | "worker": "g1t-status", | |
| 320 | "d1": { "database": "g1t-status", "migrations": "migrations" }, | |
| 321 | "stage": "edge", | |
| 322 | "secrets": ["STATUS_SECRET"], | |
| 323 | "setup": ["Email Sending on g1t.sh (the EMAIL binding)"], | |
| 324 | "self_host": "separate" | |
| 325 | }, | |
| 326 | "web": { | |
| 327 | "path": "apps/web", | |
| 328 | "kind": "react-router", | |
| 329 | "worker": "g1t", | |
| 330 | "stage": "front", | |
| Merge g1tusercontent.com: registry answers run nothing in a browser, the site's pages run only their own scripts, repository files and avatars on their own origin, raw files rate limited per address | 331 | // USERCONTENT_KEY signs the short-lived addresses of private |
| 332 | // repositories' files on g1tusercontent.com; without it they are | |
| 333 | // served from g1t.sh instead. | |
| 334 | "secrets": ["USERCONTENT_KEY"], | |
| 335 | "setup": [ | |
| preparing for cloud work | 336 | "The R2 bucket g1t-downloads, for the releases of the self-hosted runner, the CLI and the desktop app: npx wrangler r2 bucket create g1t-downloads", |
| Merge g1tusercontent.com: registry answers run nothing in a browser, the site's pages run only their own scripts, repository files and avatars on their own origin, raw files rate limited per address | 337 | "The zone g1tusercontent.com on the account; the Worker's custom domain on it is made by the deploy", |
| 338 | "The key for private files' addresses: `node -e \"console.log(require('crypto').randomBytes(32).toString('hex'))\" | npx wrangler secret put USERCONTENT_KEY` in apps/web" | |
| 339 | ], | |
| Checkout tries a failed fetch twice more, after 2 s and 5 s | 340 | "self_host": "run" |
| 341 | }, | |
| 342 | "sudo": { | |
| 343 | "path": "apps/sudo", | |
| 344 | "kind": "react-router", | |
| 345 | "worker": "g1t-sudo", | |
| 346 | "stage": "front", | |
| 347 | "secrets": [], | |
| 348 | "setup": ["A Cloudflare Access application on sudo.g1t.sh; its AUD tag is ACCESS_AUD"], | |
| 349 | "self_host": "none" | |
| 350 | }, | |
| 351 | "docs": { | |
| 352 | "path": "apps/docs", | |
| 353 | "kind": "astro", | |
| 354 | "worker": "g1t-docs", | |
| 355 | "stage": "front", | |
| 356 | "secrets": [], | |
| 357 | "self_host": "none" | |
| 358 | } | |
| 359 | } | |
| 360 | } |
This file's history is long; its oldest lines are credited to the oldest commit read.