Worker

Cloudflare Free App Stack

Deploy a free-tier app with Cloudflare Static Assets, Worker API, D1 database, token-protected admin checks, one-command deploy and production E2E verification.

Recipe intent

Use Cloudflare as the default free runtime for a small production app: static frontend, Worker API, D1 state, admin checks, deploy automation and E2E proof. GitHub Actions is optional; the free default is local pnpm deploy plus pnpm e2e, while public-template repos can use free public GitHub Actions.

SYSTEM MAP

Cloudflare free app stack

Overview App request Sign-in Media Background Deploy Observe
1 Release Worker Deploy API routes and bindings. 2 Publish UI Static assets go to the edge. 3 Sign in The UI starts auth. 4 Call API Browser traffic reaches Worker. 5 Save session Sessions land in D1. 6 Persist state App data uses D1. 7 Store media Files go to R2. 8 Queue work Cron and queues run jobs. 9 Observe Events feed analytics. 10 Gate admin Admin screens stay protected. UI Front-end Static Assets Static app bundle, route fallbackand UI assets at the edge. OAuth Authentication Better Auth + GitHub Login starts in the UI, returnsthrough the Worker, stores sessionsin D1. SQL Database Cloudflare D1 Users, sessions, app state, auditsand schema migrations. API Back-end Worker + Hono Edge API for business logic, authroutes, media and background hooks. Files Storage Cloudflare R2 Uploads, generated files and publicmedia behind Worker routes. Async Jobs Queues + Cron Scheduled work, retries and durablemulti-step background flows. CI/CD Deployment Local or GitHub Run checks, apply migrations anddeploy the Worker. Gate Admin Token + Access Protects admin screens beforeapp-level role checks and auditlogs. Ops Monitoring Logs + Analytics Request logs, product events,metrics and operational audit trail.

Good fit

Small SaaS or admin tool

Fits apps with a compact API, static UI, D1-backed users/sessions/state and moderate daily traffic.

Agent-created MVP

The repo contains deploy and E2E scripts, so an agent can provision, deploy and prove the stack without inventing glue.

Public template distribution

A public GitHub template can run free public Actions; private forks can still deploy locally for free.

Not a fit

Heavy relational workload

D1 is excellent for edge SQL state, but not a replacement for high-write OLTP systems.

Large media platform

Use R2 carefully for files, but high-volume image/video products need separate budget and lifecycle rules.

Private GitHub Actions only

Private repo Actions may hit GitHub billing or spending-limit checks; use local deploy or a public template path.

Default path

  1. 1 Create a repo from the template.
  2. 2 Set Cloudflare account credentials locally or as repo secrets.
  3. 3 Run pnpm deploy to create or reuse D1, apply migrations, write Worker secrets and publish the Worker plus Static Assets.
  4. 4 Run pnpm e2e against the production workers.dev URL.
  5. 5 Use the generated evidence file and browser screenshot as the closeout proof.

Deploy modes

Local free deploy

pnpm deploy && pnpm e2e

Default for private projects or accounts where GitHub Actions is blocked.

Public template CI/CD

git push origin main

Use when the repo is public and GitHub Actions can run standard hosted runners for free.

Manual verification

APP_URL=https://your-worker.workers.dev ADMIN_TOKEN=... pnpm e2e

Use after changing domains, secrets or deploy credentials.

Verification

  • Worker health returns ok: true and confirms D1 binding.
  • D1 write creates an item and D1 read returns that item.
  • Admin metrics returns 401 without credentials.
  • Admin metrics succeeds with the configured admin token.
  • Browser loads the production UI with no console errors and 200 responses for app assets and API calls.