Infrastructure · Cloudflare-native
The edge-native platform behind a ~15k-member developer community. About a dozen Cloudflare Workers apps share one self-hosted identity provider, per-app D1 databases, and a common set of KV, R2, Queues, Workers AI, Vectorize, and Durable Objects. One Cloudflare account, no origin servers.
One Cloudflare account, one identity spine, a fleet of edge-rendered apps sitting on a shared platform fabric.
Every request is SSR'd on a Worker; all apps authenticate through Warden and read/write per-app data stores on the same fabric.
Self-hosted OAuth 2.1 / OIDC provider — one MultiGroup login.
Astro · Better Auth · EdDSA JWKS · D1
Public community site: D1-backed CMS, newsletter, store, edge search.
Astro SSR · D1 · Workers AI · Vectorize
Visual email-template builder + bulk campaign sender on Queues.
Next.js 16 · OpenNext · Queues · Email Sending
Premium LMS with live interactive classes recorded to VOD.
Astro · Durable Objects · Realtime SFU
Map-first, gamified social index of events, cafés & places.
Astro · MapLibre · Protomaps PMTiles · D1 geo
Every app is an OIDC relying party; Warden federates login, apps gate authorization locally.
Fire-and-forget sends: the API enqueues in ~50ms; a cron + queue-consumer meter delivery against the daily cap and auto-suppress bounces.
A LiveRoom Durable Object handles presence & chat over hibernating WebSockets; media flows peer-to-SFU over WebRTC.
Warden runs OAuth 2.1 / OIDC on Workers + D1 with asymmetric (EdDSA) ID tokens and a JWKS endpoint — dropping Auth0. Four apps federate to it, yet each keeps its own sessions and local roles: login is federated, authorization stays local.
The Institute runs live classrooms on an app-authored LiveRoom Durable Object (WebSocket Hibernation, presence, chat, hand-raise, attendance → D1) fronted by Cloudflare's Realtime SFU, gated by a 60-second HMAC handshake.
app + cron + queue-consumer turn Cloudflare Email Sending's ~200/day soft cap into a feature: per-batch quota reservation in D1, park-and-resume across days, send-time bounce auto-suppression, click tracking with no open pixels — all KVKK-compliant.
Every SSR app uses a version-stamped KV read-through cache (c:ns:version:key + a cv:ns counter), so an admin write bumps a version and invalidates a whole namespace in O(1) — no purge API, guaranteed-fresh first read.
Workers AI (bge-m3, 1024-dim) → Vectorize, routed through an AI Gateway for cost logging, embeddings de-duplicated by content hash in KV — with a graceful D1 LIKE fallback when the binding is absent.