Essential session storage is required to sign in. Optional analytics remain off unless you allow them.
Build a production-shaped application entirely on Cloudflare. Include: (1) a full-stack app on Pages/Workers with D1 + R2 + KV (no traditional server); (2) edge logic in a Worker that runs before the origin/app (auth or A/B or rewriting); (3) INFRASTRUCTURE AS CODE — manage DNS, WAF/firewall rules, and Workers config with the Cloudflare Terraform provider and/or wrangler.toml in CI/CD, with secrets handled properly; (4) protect an admin route with Cloudflare Access (Zero Trust, identity-aware) and/or expose a private service via a Cloudflare Tunnel (outbound-only, no open inbound ports); and (5) observability (Logpush or wrangler tail, analytics, alerts). Document the architecture and how config is reproducible.
App runs on Pages/Workers + D1/R2/KV with no traditional server; edge logic runs before the app; works end-to-end.
DNS/WAF/Workers managed as code (Terraform provider / wrangler.toml) in CI/CD; reproducible; secrets handled safely.
Access protects a route (identity-aware) and/or a Tunnel exposes a private service outbound-only with no open inbound ports.
Logging/analytics/alerts wired; architecture documented; config reproducible.
Use this README structure to make the work reviewable.
DevPath fetches a read-only, size-capped snapshot. Submitted code is never executed.
# A full-stack edge app with IaC and Zero Trust ## Goal Build a production-shaped application entirely on Cloudflare. Include: (1) a full-stack app on Pages/Workers with D1 + R2 + KV (no traditional server); (2) edge logic in a Worker that runs before the origin/app (auth or A/B or rewriting); (3) INFRASTRUCTURE AS CODE — manage DNS, WAF/firewall rules, and Workers config with the Cloudflare Terraform provider and/or wrangler.toml in CI/CD, with secrets handled properly; (4) protect an admin route with Cloudflare Access (Zero Trust, identity-aware) and/or expose a private service via a Cloudflare Tunnel (outbound-only, no open inbound ports); and (5) observability (Logpush or wrangler tail, analytics, alerts). Document the architecture and how config is reproducible. ## Acceptance criteria - [ ] Full-stack on the edge: App runs on Pages/Workers + D1/R2/KV with no traditional server; edge logic runs before the app; works end-to-end. - [ ] IaC & CI/CD: DNS/WAF/Workers managed as code (Terraform provider / wrangler.toml) in CI/CD; reproducible; secrets handled safely. - [ ] Zero Trust: Access protects a route (identity-aware) and/or a Tunnel exposes a private service outbound-only with no open inbound ports. - [ ] Observability & docs: Logging/analytics/alerts wired; architecture documented; config reproducible. ## Verification - [ ] Document installation and run commands. - [ ] Record automated checks and their exact commands. - [ ] Add representative output, screenshots, or a short demo where useful. - [ ] Confirm failure paths and known constraints. ## Decision log ### Decision title - Context: - Choice: - Alternatives considered: - Tradeoffs: ## Evidence - Link each rubric criterion to the file, test, or artifact that demonstrates it. ## Known limitations - List what is intentionally out of scope and what should be improved next.