Cloudflare deployment#
install-path-decisions#
The runtime image installs tigrisfs from the upstream tigrisdata/tigrisfs release tarball, not Alpine packages. L3 pins v1.2.1 and SHA256 9fd6e7a9f3e7d86571ea55c66459205e94dfa5f6a25887d7e95c0a46f7641ed4; source: https://github.com/tigrisdata/tigrisfs/releases/tag/v1.2.1.
Cloudflare Containers place sleepAfter on the Container class, so worker.js sets sleepAfter = "30m" on AerieContainer; source: https://developers.cloudflare.com/containers/container-class/. Operator SSH is disabled in Wrangler config with [containers.ssh] enabled = false; source: https://developers.cloudflare.com/workers/wrangler/configuration/#ssh.
Required operator secrets and KNOT_SERVER_ENABLE_HTTPS_PUSH=true are passed to the container with the envVars class field because Cloudflare documents container environment variables there; source: https://developers.cloudflare.com/containers/examples/env-vars-and-secrets/.
env vars#
Operators must set required secrets with wrangler secret put before deployment:
| variable | purpose |
|---|---|
R2_BUCKET |
R2 bucket used for repo mount and SQLite DB snapshot |
R2_ENDPOINT |
S3-compatible R2 endpoint |
R2_ACCESS_KEY_ID |
R2 access key ID |
R2_SECRET_ACCESS_KEY |
R2 secret access key |
KNOT_SERVER_HOSTNAME |
public knot hostname |
KNOT_SERVER_OWNER |
owner DID required by the knot server |
KNOT_SERVER_ADMIN_SECRET |
Basic-auth secret for narrow administrative endpoints such as member ACL sync |
worker.js passes these required values plus KNOT_SERVER_ENABLE_HTTPS_PUSH=true into the container. See knotserver/config/config.go for the full inherited knot environment surface.
ops#
Install JS deps once per fresh clone before the first deploy: npm install. The Worker shim at deploy/cloudflare/worker.js imports @cloudflare/containers, which wrangler bundles at deploy time; node_modules/ is gitignored, so the install must happen locally. The declared dep lives in the repo's top-level package.json (single entry: @cloudflare/containers).
Build locally with make build-image or directly with docker build -f deploy/cloudflare/Dockerfile -t aerie:local ..
The repo .dockerignore excludes **/Dockerfile from the build context. Passing this Dockerfile with -f deploy/cloudflare/Dockerfile is intentional and still works; do not move the Dockerfile to work around the ignore rule.
ci-image is operator-side: it runs make ci and then builds the image. It is not part of the default make ci gate.
post-v1#
Future deployment work remains outside L3: AC16 (sh.tangled.knot ownership record published at first instance ready), opportunistic mid-run sync, and any KNOT_POST_RECEIVE_HOOK_CMD scoping.