Vertex — Cloudflare

Account: The Tax Graph · Zone: thetaxgraph.com (full setup, Free plan)

Resources

Resource	stage	prod
Worker (console SPA + API reverse proxy)	vertex-stage	vertex-prod
Hostname	stage-<subdomain>.thetaxgraph.com	<subdomain>.thetaxgraph.com
Tunnel	vertex-stage	vertex-prod
Browser access	TTG + vendor IPs only	TTG users (Google SSO)

The legacy Worker vertex-console and the unrelated horizon-scanner Worker live in the same account and are not touched.

Worker configuration

• Lives in ttg-infra/apps/vertex/cloudflare/wrangler.toml with [env.stage] and [env.prod] blocks (Worker names vertex-stage / vertex-prod, origin settings per env).
• The vertex repository keeps no Cloudflare token and no deploy workflow.
• Worker behaviour carried over from legacy: run_worker_first = true, no not_found_handling = "single-page-application"; the Worker proxies /auth and /api first and serves the SPA shell itself.

Tunnel ingress (one tunnel per env)

ingress:
  - hostname: <origin-host>.thetaxgraph.com
    path: ^/(auth|api/auth|api/users)(/|$)
    service: http://localhost:8030     # identity
  - hostname: <origin-host>.thetaxgraph.com
    service: http://localhost:8020     # core
  - service: http_status:404           # required catch-all

Tunnel tokens are created by the TTG operator and stored in vertex-<env>/app (key tunnel-token).

API tokens

Token	Type	Permission	Stored in
Deploy token	Account-owned, scope Specified Workers	Workers Editor on vertex-stage and vertex-prod only	ttg-infra repository secret
Operator	Wrangler OAuth login (wrangler login --use-keyring)	User rights	Operator machine keychain

Per-Worker roles only apply to Workers that already exist; creating a Worker needs product-level Admin. wrangler login (OAuth) does not support granular permissions, so automation always uses the scoped token.

Private docs site

This documentation site is also a Worker protected by Cloudflare Access (Zero Trust, free up to 50 users): Access checks every request at the edge and shows a login page before the Worker runs.

Sources

Workers roles and permissions · Wrangler auth profiles · Tunnel configuration file · Workers + Access · Zero Trust plans